Full research report

Hunting MacSync Stealer infrastructure through behavioral pivots

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

MacSync Stealer is a well-documented, actively evolving macOS information stealer operating as a Malware-as-a-Service with confirmed in-the-wild deployment against U.S. government and commercial targets since at least December 2025. Its operators demonstrated a 24-hour C2 infrastructure replacement capability in May 2026, but Microsoft's August 2026 analysis shows that URI patterns, a shared static API key, curl command-line flags, and chunked exfiltration parameters are significantly more durable than domains and give defenders reliable hunting pivots that survive rotation. The most operationally significant capability beyond credential theft is the hardware wallet trojanization stage, which injects seed-phrase phishing into locally installed Ledger and Trezor applications and represents a targeted financial theft layer absent from most infostealers. Attribution remains limited to circumstantial indicators—Russian-language code comments and an unverified campaign label—and the MaaS distribution model means multiple unrelated operators may be running identical tooling against different victim sets simultaneously.

What happened

MacSync Stealer is a macOS information stealer distributed as a Malware-as-a-Service offering, active across at least three tracked campaign waves since December 2025. RST Cloud first documented the C2 rotation pattern on 8 May 2026, identifying four API-key-linked domains and a 24-hour replacement window after public disclosure. On 18 August 2026, Microsoft Defender Experts published an expanded analysis correlating more than 30 domains through durable behavioral traits, demonstrating that infrastructure hunting via behavioral pivots outperforms domain-centric tracking for this family. U.S. SLTT government organisations are confirmed targets per CIS advisory, and confirmed exfiltration—not merely beaconing—has been observed.

Affected scope

macOS endpoints across multiple sectors; U.S. SLTT government organisations specifically named by CIS. A signed, notarised Swift variant (developer Team ID GNJLS3UYZ4, now revoked) bypassed Gatekeeper. Ledger Wallet, Ledger Live, and Trezor Suite installations are subject to in-place trojanization on targeted hosts. The MaaS distribution model implies victimology broader than any single sector.

Technical assessment

Initial access relies on ClickFix social engineering: victims paste an attacker-supplied zsh command into Terminal, initiating a multi-stage loader. The loader retrieves a server-side AppleScript payload over /curl/ paths, checks in via /dynamic?txd= with the account password embedded in the query string in cleartext, collects Keychain material, browser credentials, SSH and cloud keys, and sensitive files, then stages them as /tmp/osalogging.zip before exfiltrating in 10 MiB chunks via HTTP PUT to /gate?buildtxd=. A static API key persists across C2 deployments while the build token rotates per deployment, providing a reliable infrastructure attribution anchor. Some deployments include a native Mach-O RAT granting persistent shell access and a hardware wallet trojanization stage that injects a seed-phrase phishing wizard into locally installed Ledger and Trezor applications using ad-hoc signing to survive Gatekeeper.

Recommended defensive actions

  1. Apply macOS 26.4 or later, which adds ClickFix paste-blocking warnings and updated XProtect signatures designed to disrupt this delivery chain.
  2. Block or alert on HTTP requests matching URI patterns /curl/, /dynamic?txd=, and /gate?buildtxd= at web proxy or DNS filtering layer.
  3. Hunt for zsh process chains combining base64, gunzip, and eval execution in sequence, which are durable process-level indicators across all known variants.
  4. Monitor for creation of /tmp/osalogging.zip and subsequent curl HTTP PUT requests containing upload_id, chunk_index, and total_chunks query parameters.
  5. Audit locally installed Ledger Wallet.app, Ledger Live.app, and Trezor Suite.app bundles: verify code signing against the legitimate vendor certificate and compare ElectronAsarIntegrity hashes to detect trojanized replacements.
  6. Enable cloud-delivered protection and tamper protection in Microsoft Defender; SLTT entities should subscribe to MS-ISAC for campaign-specific IOC feeds, which have already blocked over 2.5 million DNS requests related to this campaign.

Uncertainties and evidence gaps

  • Threat actor identity is unconfirmed; 'Mentalpositive' is an RST Cloud campaign label and Russian-language code comments are circumstantial only—no technical link to a named group has been published.
  • Whether the 30+ correlated domains represent a single operator or multiple MaaS buyers using identical loader templates is unresolved; the shared API key is consistent with both a single operator and a common template sold to separate buyers.
  • The full extent of active C2 infrastructure beyond the 30+ domains Microsoft identified is unknown; the analysis treats the domain count as an output of behavioral correlation, not an exhaustive enumeration.
  • Exploitation of sectors beyond U.S. SLTT government has not been ruled out; the MaaS model suggests broader victimology that may not yet be documented in public advisories.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNo remote network exposure required; victim must be socially engineered via ClickFix, malvertising, or weaponised shared content into pasting an attacker-supplied command into a local Terminal session.
ComponentmacOS zsh/Terminal execution context, Keychain credential store, browser data directories, SSH and cloud configuration files, and locally installed hardware wallet applications.
MechanismA lure page or shared document instructs the victim to paste a single Terminal command; execution launches a multi-stage shell loader that downloads attacker-controlled payloads into memory via curl, collects credentials and sensitive files with AppleScript assistance, and uploads them in chunks to rotating C2 domains.
ImpactFull theft of browser credentials, SSH and cloud access keys, macOS Keychain contents, and cryptocurrency wallet material; persistent remote shell access in RAT-bearing deployments; hardware wallet seed phrases compromised via trojanised Ledger and Trezor applications.
DetectionAnomalous zsh process chains combining base64 -D, gunzip, and eval; outbound requests to /dynamic?txd= or /gate?buildtxd= URI patterns; creation of /tmp/osalogging.zip; curl HTTP PUT with chunk upload query parameters; LaunchAgent persistence entries masquerading as Adobe, Google, Microsoft, or Dropbox updaters; /tmp/macsync_<token>.lock mutex file.
MitigationApply macOS 26.4+ for built-in ClickFix paste warnings and XProtect updates; block known C2 URI patterns at proxy; revoke and distrust Apple developer Team ID GNJLS3UYZ4; enable Defender cloud-delivered protection and network protection.
Exploitation status

No CVEs are associated with this story. MacSync Stealer is actively deployed in the wild with confirmed data exfiltration from compromised macOS endpoints across multiple campaign waves since at least December 2025, delivered entirely through social engineering rather than software vulnerabilities.

Research process

Investigation began by fetching the primary Microsoft Defender Experts article, which provided the full technical baseline and explicitly referenced RST Cloud's prior reporting as its analytical starting point. Parallel searching identified five independent corroborating organisations—CIS, Jamf, Huntress, CloudSEK, and SOC Prime—each of which was verified by fetching the source page before inclusion. The combined evidence supports a high-confidence assessment of an actively deployed, well-documented macOS stealer with confirmed government-sector victimology and a clear behavioral detection surface.

  1. What does the primary Microsoft source contain, and does it support the article's claims about behavioral pivots and 30+ domains?
    Fetched the Microsoft Security Blog article directly.
    microsoft.com ↗

    Full six-stage attack chain confirmed; 30+ domains linked via URI patterns (/curl/, /dynamic?txd=, /gate?buildtxd=), API-key headers, macOS User-Agent, and chunked curl PUT upload parameters; macOS 26.4+ mitigation noted.

    why Establishes the primary source as credible and detailed; forms the analytical baseline and confirms all major claims in the article text.

  2. What independent reporting exists on MacSync Stealer, and from which organisations?
    Searched for 'MacSync Stealer macOS malware 2026'.

    Independent coverage confirmed from CIS, Jamf, Huntress, CloudSEK, RST Cloud, SOC Prime, and Daylight.ai; campaign active since December 2025 with a third wave in February 2026; Google Ads and Claude.ai shared chats used as lure vectors.

    why Establishes the breadth of independent corroboration across at least five distinct organisations before any individual source is fetched.

  3. What sectors are targeted and what does the CIS advisory confirm?
    Fetched the CIS advisory.
    cisecurity.org ↗

    U.S. SLTT government organisations confirmed as primary target sector; third campaign wave started February 2026; MDBR service blocked 2.5M+ DNS requests; hardcoded API key 5190ef1733183a0dc63fb623357f56d6 independently confirmed.

    why Government advisory independently confirms the API key value and establishes real-world deployment against a specific high-value sector, strengthening confidence in the infrastructure attribution methodology.

  4. What did RST Cloud's original C2 rotation research find, and how does it relate to Microsoft's expanded analysis?
    Searched for RST Cloud MacSync research, then fetched the RST Cloud article.
    rstcloud.com ↗

    Four confirmed domains share static API key; operators replaced C2 within 24 hours of public disclosure on 1 May 2026; eleven additional candidate domains identified by URI pivoting; build token rotates per deployment while API key persists.

    why RST Cloud is the prior research that Microsoft explicitly builds upon; direct verification confirms the API key value, the rapid replacement timeline, and the distinction between API-key-confirmed and URI-pattern-candidate domains.

  5. What does the Jamf analysis reveal about the signed Swift variant and Apple's response?
    Fetched the Jamf Threat Labs blog post.
    jamf.com ↗

    A code-signed and notarised variant used developer Team ID GNJLS3UYZ4; certificate revoked after Jamf reported it to Apple; payload retrieved from gatemaden.space/curl/ with modified curl flags; rate-limited execution via timestamp file at ~/Library/Application Support/UserSyncWorker/.

    why Documents significant malware evolution to signed delivery; confirms Apple's revocation response and provides a concrete indicator (Team ID) for defenders performing code-signing audits.

  6. What does the Huntress reverse engineering reveal about the RAT stage, actor indicators, and the full attack chain?
    Fetched the Huntress blog post.
    huntress.com ↗

    Full six-stage chain confirmed including native Mach-O RAT providing persistent shell access, screen capture helper, and wallet trojanization; Russian-language comments ('ВСТАВЬТЕ СЮДА') in recovered AppleScript; malware self-labels as 'MacSync Stealer v1.1.2_release'; delivery observed via weaponised Claude.ai shared conversations.

    why Provides the deepest independent technical analysis of the complete chain; Russian-language indicator is relevant context for actor profiling but is explicitly marked as circumstantial.

  7. Does CloudSEK's hardware wallet trojanization analysis add independently verified detail?
    Fetched the CloudSEK blog post.
    cloudsek.com ↗

    Trojanization selectively replaces only app.asar and Info.plist, preserving legitimate bundle structure; ad-hoc signing applied to bypass Gatekeeper; three-step phishing wizard replicates hardware device interface for 24-word seed phrase capture; eight rotating jmpbowl.* C2 domains noted.

    why Independently confirms the hardware wallet trojanization mechanism with technical specificity; ad-hoc signing bypass has direct implications for integrity verification defensive guidance.

Named in this story
ActorsUnknown MaaS operator(s); 'Mentalpositive' campaign label assigned by RST Cloud tracking (unverified attribution)Possible Russian-speaking developer (circumstantial: Russian-language code comments in recovered AppleScript)
MalwareMacSync StealerMac.c Stealer (predecessor family)AMOS/Atomic Stealer (related family with shared techniques)
TargetsmacOS users broadlyU.S. SLTT government organisationsCryptocurrency wallet holders (Ledger, Trezor, MetaMask, Exodus, Electrum)Enterprise SSH, AWS, and Kubernetes credential stores

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 60 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
Microsoft Securitynews ok1 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok7 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1670 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5324 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok685 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1009 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok7785 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok16 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok9 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 6 opened outside the registered collection
References & evidence
PoC & exploit code2
Reverse Engineering the Six Stages of MacSync Stealer and RAT huntress.com ↗

Full technical breakdown of all six attack stages including the native Mach-O RAT; Russian-language code comments noted as a circumstantial origin indicator.

Inside MacSync's Script-Driven Stealer and Hardware Wallet App Trojanization cloudsek.com ↗

Detailed analysis of Ledger and Trezor trojanization mechanism and ad-hoc code signing bypass technique.

Vendor & gov advisories1
MacSync Stealer Campaign Impacting U.S. SLTT macOS Users cisecurity.org ↗

CIS advisory covering the third campaign wave (February 2026) targeting U.S. state, local, tribal, and territorial government organisations; confirms API key and MDBR block counts.

Analysis & research4
Hunting MacSync Stealer infrastructure through behavioral pivots microsoft.com ↗

Primary source; Microsoft Defender Experts correlate 30+ C2 domains through recurring URI patterns, curl flags, API-key headers, and chunked upload parameters.

MacSync Stealer: C2 Infrastructure Rotation rstcloud.com ↗

Prior research that Microsoft builds upon; confirms static API key 5190ef1733183a0dc63fb623357f56d6 linking four domains and a 24-hour C2 replacement window after public disclosure.

MacSync Stealer Evolves: From ClickFix to Code-Signed Swift Malware jamf.com ↗

Documents the signed and notarised Swift delivery variant; developer Team ID GNJLS3UYZ4 revoked after Jamf reported it to Apple.

MacSync Stealer Uses Rotating C2 Infrastructure socprime.com ↗

SOC Prime coverage with detection rule context for behavioural and IOC-based hunting on the C2 rotation pattern.