threat-intel
Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure
High
Summary
Microsoft has linked over 30 web domains to MacSync Stealer, a macOS information stealer, after observing recurring network behaviors and endpoint activity. The malware uses various techniques, including AppleScript, to collect sensitive data like credentials, browser history, and SSH keys, and then exfiltrates it through HTTP PUT requests. The activity is linked to a broader ClickFix campaign involving over 250 front-end domains. Microsoft advises organizations to educate users about risky Terminal commands and monitor for suspicious network activity.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data