Microsoft has recently identified over 30 web domains associated with MacSync Stealer, a malware targeting macOS systems. This discovery was made by analyzing endpoint and network behaviors, which revealed a pattern of infrastructure changes related to the malware’s operations. The findings highlight a comprehensive tracking of MacSync’s activities, from payload retrieval to data exfiltration.
Investigative Techniques and Analysis
To confirm the connection between the domains and MacSync Stealer, Microsoft correlated various network and endpoint behaviors. These included examining process ancestry, command-line patterns, and request paths, which collectively confirmed the domains’ involvement with the malware. Despite the thorough investigation, Microsoft has not disclosed the number of affected victims or attributed the activity to a specific threat actor.
The analysis detailed the malware’s execution, which starts from an interactive zsh Terminal session, often initiated through social engineering tactics. Subsequent operations involve using ‘curl’ to fetch attacker-controlled content and employing utilities like Base64 for decoding the payload. The payload execution leverages osascript for AppleScript, aiding in the malware’s data collection process.
Data Collection and Exfiltration
MacSync Stealer gathers extensive information, including host and user data, macOS Keychain contents, browser credentials, and sensitive files. This data is staged in temporary directories, compressed, and then exfiltrated using HTTP PUT requests. The malware employs specific parameters, such as upload identifiers and chunk indexes, to manage the data transfer, subsequently erasing traces of its activities post-exfiltration.
Supporting the findings, RST Cloud’s prior analysis had reported a static API key across several command-and-control domains, further identifying additional domains through specific URI patterns. Overlapping submission windows suggested simultaneous operations rather than a sequential rotation of domains, highlighting the complexity of the malware’s infrastructure.
Recommendations and Future Outlook
In response to these findings, Microsoft advises organizations to educate users against running unverified Terminal commands and to monitor for unusual shell activities that could signal malware presence. Additionally, correlating AppleScript-assisted activities with outbound traffic is crucial for timely detection. Investigating connections to new or suspicious domains remains a priority for ongoing security measures.
Apple has introduced protections in macOS, such as Terminal paste protection and AppleScript scanning, to counteract threats like MacSync Stealer. These measures, alongside Microsoft’s continuous monitoring efforts, aim to mitigate the impact of such sophisticated malware campaigns. The recent disclosure follows Microsoft’s earlier report of over 250 domains involved in distributing MacSync and related malware, underscoring the persistent threat landscape targeting macOS systems.
