Microsoft Defender Experts published infrastructure in August 2026 linking more than 30 domains to MacSync, an information stealer that targets macOS. Microsoft says it observed active data exfiltration rather than beaconing alone, and did not attribute the activity to a named group or give a victim count.

The initial analysis came from RST Cloud on 8 May 2026.

What it takes

The list is longer than the usual browser-password haul, and it is aimed at people who build things:

  • macOS Keychain material
  • Browser credentials, cookies, session data and history
  • SSH keys
  • AWS credentials
  • Kubernetes configurations
  • Apple Notes
  • Files from the usual user directories, plus host and user details

Session cookies and SSH keys are the two that hurt most. A password can be rotated after you notice; a live session cookie is already authenticated, which is the same reason AmnesiaStealer's browser-session hijacking mattered more than its credential theft did.

How it gets there

Nobody is exploiting anything. Someone is asking.

Execution starts in an interactive zsh Terminal session — the signature of a ClickFix campaign, where a compromised or fake page shows a "fix this" or "verify you are human" step and asks the visitor to copy a command and paste it into Terminal. The victim runs the malware themselves, with their own privileges, having been told it will solve a problem.

Apple has shipped a countermeasure. macOS 26.4 and later adds paste protection in Terminal, blocks commands arriving through the pasteboard, and scans AppleScript. If your fleet is behind 26.4, that upgrade is a control, not a nice-to-have.

The domains are the interesting part

The 32 domains Microsoft published are not the usual random strings. They read as ordinary small businesses — a North Carolina cabin rental, a Georgia dog trainer, a Delaware home inspector, a Dayton mould inspector, a New Jersey pet sitter, a San Diego taekwondo school, a Miami PC support shop — mixed with plausible-sounding AI companies whose names end in "agent".

That naming is deliberate and it works on two audiences at once. A person glancing at a URL sees a real-looking local business. An analyst reviewing proxy logs sees a domain that does not look like malware infrastructure and moves on. It is the same reasoning behind seven million expired domains bought for their reputation: the value is in not looking like anything.

The mistake that makes it findable

Here is the useful part for anyone hunting.

RST Cloud's analysis notes that the hex build token rotates on every deployment — but the api-key does not. The operator carefully varies the thing that identifies a build, and reuses the thing that identifies the operator. One static string sits across the whole campaign, which turns "find every sample" into a single search.

The rest of the traffic pattern is similarly consistent:

  • Standardised URI paths — /curl/, /dynamic?txd= and /gate?buildtxd=
  • macOS user-agent strings and an api-key header
  • Exfiltration by HTTP PUT with upload_id, chunk_index and total_chunks parameters

On the host, the staging is just as fixed: data is collected under /tmp/sync* directories, compressed into /tmp/osalogging.zip, split into chunks, uploaded, and the temporary files removed.

What to do

  • Get to macOS 26.4 or later. It directly targets the delivery method.
  • Tell people the actual rule: never paste a command into Terminal because a web page asked you to. No legitimate site does this. This is one sentence and it stops the whole campaign.
  • Alert on Terminal spawning curl or a download, then executing what it fetched. That sequence has almost no honest use on a developer laptop and it is the entire chain here.
  • Hunt for the static artefacts. The /tmp/osalogging.zip filename and the /tmp/sync* staging directories are free detections, and so is a PUT carrying chunk_index.
  • Correlate AppleScript activity with Keychain access and archive creation, which is Microsoft's own guidance and catches the collection step rather than the delivery.
  • Treat an infected Mac as a cloud incident. If AWS credentials and kube configs were on it, rotating the laptop's password is not the remediation.

What is not established

  • Who runs it. Microsoft named no actor.
  • How many are affected. No victim count was published.
  • Whether the domain list is complete. It is what Microsoft could tie together, and the naming scheme is trivially extensible.
  • Whether the api-key stays static. It has so far. Publishing that fact is usually how it stops being true.