MacSync Stealer changes domains, but leaves recurring behaviour

Microsoft’s 18 August investigation expanded an earlier view of MacSync Stealer by following recurring network and execution behaviour. Researchers connected more than 30 domains and found infrastructure involved in collection, staging and data transfer as well as command-and-control.

The report describes activity beginning with an interactive shell session consistent with ClickFix social engineering. It then tracks repeated request characteristics and upload methods across changing domains. A list of blocked addresses can become stale as an operator replaces them. Behavioural evidence can help an investigation follow the same activity after that change, provided analysts validate it against their own telemetry. Microsoft’s findings concern the cluster it examined and do not establish that every similar request belongs to MacSync.