Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors across changing infrastructure. The malware's lifecycle from payload retrieval through data collection, staging, and exfiltration was traced, with the rotating domain infrastructure observed to aid evasion of static blocklists.

Which products are affected?

MacSync Stealer, Microsoft Defender

What should defenders do?

Microsoft recommends keeping macOS systems updated with the latest security patches, using Microsoft Defender Antivirus or compatible endpoint detection and response solutions, and exercising caution with unverified downloads and attachments. No specific vendor patch was issued for the domains, as they represent infrastructure-level mitigations. Users should monitor Microsoft security advisories for updates.

highMalware

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

MacOS Information Stealer Leverages Changing Web Domains for Command-and-Control Evasion

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

Key Takeaways

Microsoft Defender Experts linked over 30 rotating web domains to the MacSync Stealer macOS information stealer.
The correlation was based on recurring endpoint and network behaviors aligning across changing infrastructure.
The domain rotation mechanism aids evasion of static blocklists and supports command-and-control persistence.

Related Security News

highCyber Attacks

Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.

BleepingComputerabout 5 hours ago1 min read