Microsoft Exposes 30+ Rotating Domains Behind MacSync Stealer Campaign

Introduction

In a significant threat intelligence disclosure, Microsoft Defender Experts have peeled back the operational layers of MacSync Stealer, a macOS-focused information stealer that has been quietly harvesting credentials, cryptocurrency wallets, and browser data from compromised Apple devices. The investigation reveals a surprisingly resilient infrastructure built on more than 30 rotating web domains, orchestrated to evade detection while maintaining persistent command-and-control channels. This research underscores a growing reality: macOS is no longer a niche target but a primary focus for financially motivated threat actors employing sophisticated infrastructure management techniques.

Anatomy of a Rotating Infrastructure

The hallmark of the MacSync Stealer campaign is its dynamic domain rotation strategy. Rather than relying on a static set of command-and-control (C2) servers, the operators cycle through a pool of over 30 domains, registering and abandoning them in rapid succession. This tactic, often referred to as "fast flux" or domain generation algorithm (DGA) adjacent behavior, complicates traditional blocklisting approaches. By the time a domain is flagged and added to threat feeds, the malware has already migrated its communication to a fresh endpoint.

Microsoft's analysis indicates that this rotation is not random but follows a deliberate operational tempo. The domains share registration patterns, hosting providers, and SSL certificate characteristics, creating a fingerprint that defenders can track despite the surface-level volatility. This infrastructure agility suggests a well-resourced operator, likely operating under a Malware-as-a-Service (MaaS) model where affiliates deploy the payload while the core developers maintain the backend.

Behavioral Correlation: The Key to Attribution

Attributing this shifting infrastructure to a single threat actor required moving beyond static indicators of compromise (IOCs). Microsoft Defender Experts employed a behavioral correlation engine that monitored for recurring patterns across the kill chain. The breakthrough came from aligning multiple telemetry sources:

• Endpoint Telemetry: Consistent process execution chains, file drop locations, and persistence mechanisms (LaunchAgents/LaunchDaemons) across disparate infections.
• Network Telemetry: Identical HTTP request structures, User-Agent strings, and TLS JA3 fingerprints connecting to the rotating domain set.
• Temporal Alignment: Synchronized campaign bursts where new domains appeared concurrently with updated payload hashes distributed via phishing or trojanized software.

Only when these independent signals converged did the analysts confidently cluster the activity under the MacSync Stealer umbrella. This methodology highlights the industry's necessary shift from IOC-chasing to behavior-based threat hunting.

The Kill Chain: From Delivery to Exfiltration

The research maps the complete operational lifecycle of the stealer:

1. Initial Access: Distribution primarily via malicious advertisements (malvertising) and SEO poisoning, directing victims to fake software download sites mimicking legitimate utilities (e.g., video converters, productivity tools).
2. Payload Retrieval: A lightweight downloader (often a Mach-O binary signed with revoked or ad-hoc certificates) fetches the main stealer module from the rotating domain set.
3. Data Collection: The stealer targets a broad spectrum of high-value data: Keychain entries, browser cookies and autofill data (Chrome, Safari, Firefox), cryptocurrency wallet files (Exodus, Electrum, Atomic), Telegram session data, and SSH keys.
4. Staging & Exfiltration: Collected data is compressed, encrypted (typically AES-256), and staged in a hidden local directory before being posted to the C2 via HTTP POST requests. The use of legitimate cloud storage APIs (observed in some variants) for staging further blends malicious traffic with benign user activity.

Conclusion

The exposure of MacSync Stealer's 30-plus domain infrastructure serves as a stark reminder that the era of "security through obscurity" for macOS is definitively over. Threat actors are applying enterprise-grade DevOps practices—CI/CD for payload generation, infrastructure-as-code for C2 rotation, and telemetry evasion testing—to maximize the lifespan of their campaigns. For security teams, the lesson is clear: static blocklists are a losing battle. Resilience lies in detecting the invariant behaviors—how the malware interacts with the OS, the network, and the data—regardless of where the domains point today. Grivyonx Cloud's AI-driven behavioral analytics engine is purpose-built to surface these invariant patterns, correlating endpoint telemetry with network flow data to identify stealer activity long before the domains hit the threat feeds, ensuring your Mac fleet remains protected against the next rotation.