Hunting MacSync Stealer infrastructure via behavioral pivots

Wed, 19 Aug 2026 11:36:35 +0000

Engineer — Learn: MacSync Stealer targets macOS endpoints and could affect developer machines or macOS-based CI runners; no patch or configuration action exists, but understanding that this stealer rapidly rotates C2 domains should inform endpoint coverage decisions for macOS assets.
SOC/IR — Act: Microsoft’s analysis identifies 30+ MacSync Stealer-attributed domains via durable behavioral pivots; hunt for connections to those domains in DNS and proxy logs since the start of MacSync activity, and encode the stable behavioral signals as detections to survive future domain rotation.
Leader — Skip

Macos-Stealer on CuraSec