Behavior tracking beats domain blocking in MacSync fight

Blocking malicious domains has long been a first line of defense against malware infrastructure, but for MacSync Stealer, that approach has proven to be a game of whack-a-mole. Microsoft's threat-hunting team says it has found a more durable method: track the behavior of the malware itself, not the addresses it uses.

The limits of domain blocking

MacSync Stealer is a macOS infostealer that harvests a wide range of sensitive data: passwords, browser data, cookies, Keychain secrets, cryptocurrency wallets, Telegram sessions, and SSH and cloud credentials. It has been distributed through ClickFix scams, where victims visit a malicious website that claims their browser is outdated or that a document is “protected” and requires identity verification. The site then instructs the user to open Terminal and paste a command that, in reality, deploys the malware.

Initially, defenders kept Mac fleets safe by blocking the domains that hosted the malware's infrastructure — the websites, the malware executables, and the exfiltrated data. But this approach quickly hit a wall. As soon as one domain was blocked, a new one popped up, and the malware continued its operations unabated.

A behavioral pivot

In a new report, Microsoft said it successfully identified more than 30 domains by analyzing behavioral patterns such as repeated execution, request characteristics, staging behavior, and upload methods. This shift from blocking to observing represents a significant change in how defenders can approach this particular threat.

“Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration,” Microsoft explained.

The key takeaway from Microsoft's analysis is that defenders should not focus solely on blocking domains. Instead, they should pay close attention to shell sessions spawning 'curl' with specific flag combinations, osascript quickly chaining into network activity, and archives appearing under /tmp/sync just before outbound PUT traffic begins.

Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration.

— Microsoft, in its report on MacSync Stealer

Key behavioral indicators

Microsoft highlighted several specific behaviors that can serve as indicators of MacSync Stealer activity. These include:

• Shell sessions spawning 'curl' with specific flag combinations
• osascript quickly chaining into network activity
• Archives appearing under /tmp/sync just before outbound PUT traffic begins

These patterns are not just random artifacts; they point to a systematic approach by the malware's operators to stage and exfiltrate data, which defenders can now monitor for proactively.

Why this matters for defenders

This report suggests that for MacSync Stealer, the traditional playbook of blocking domains is insufficient. The malware's infrastructure is designed to be resilient, with new domains springing up as soon as old ones are cut off. By shifting focus to behavioral analysis, defenders can potentially stay ahead of the threat, even as the infrastructure evolves.

For organizations with macOS fleets, this means investing in monitoring solutions that can detect these specific behavioral patterns, rather than relying solely on domain blocklists. It also underscores the importance of user education, as the initial infection vector is a social engineering scam that tricks users into running malicious commands.

Ultimately, this is a reminder that malware defense is an evolving field. As attackers adapt their infrastructure, defenders must adapt their strategies too. Behavioral analysis offers a more durable approach than static blocklists, and Microsoft's findings provide a concrete example of how that can work in practice.