Microsoft Ties 30-Plus Rotating Domains to MacSync, the Mac Password Stealer

Microsoft Defender Experts have linked more than 30 rotating web domains to MacSync Stealer, a macOS information stealer built to loot passwords and cloud keys off Macs. They followed the same endpoint and network habits as the operators swapped hostnames, from the first payload grab through collection, staging, and the actual theft. Microsoft did not give a victim count and did not name a threat actor. The company said, “The investigation also confirmed active data exfiltration, not just beaconing.”

That work is in an August 18, 2026 analysis from Microsoft. A domain only made the list if several signals lined up together: process ancestry, command-line patterns, request paths, headers, and upload parameters. That is the right way to hunt this stuff. The domain names are disposable. The behavior is not.

ClickFix is how they get a foot in the door

Observed execution started in an interactive zsh Terminal session, which Microsoft said is consistent with ClickFix social engineering. That is the con in plain English. A website, chat message, or fake “fix” tells a person to copy a command and paste it into Terminal. No fancy exploit required. You do the work for them.

It pisses me off because this is not some elite break-in. It is a fake page telling a regular person to paste a command so a problem will go away. From there, curl pulled attacker-controlled content over a repeating /curl/ path. Native tools such as Base64 and gunzip unpacked the payload. Then osascript kicked in for AppleScript-assisted execution, mixed with ordinary macOS and Unix utilities. Nothing exotic. That is why it blends in on a real Mac.

What MacSync takes from a Mac

This is not a prank. Once it is running, MacSync collects:

Host and user information
macOS Keychain material
Browser credentials, cookies, history, and session data
Apple Notes
SSH keys
Amazon Web Services (AWS) credentials
Kubernetes configurations
Sensitive files from common user directories

If you keep logins in Keychain, that is your vault. If you develop on a Mac, AWS keys and SSH keys are the keys to the shop. Kubernetes configs are the map to your cloud. This malware is built to steal all of it, which is why a home Mac and a small-business Mac are both worth their time.

Stolen data gets staged under /tmp/sync*, packed into /tmp/osalogging.zip, split into chunks, and uploaded with curl over HTTP PUT. Recurring parameters include upload_id, chunk_index, and total_chunks. After the upload, it deletes the temp archives, staging folders, lock files, and other leftovers. Cleaned up like a burglar who wipes the doorknob.

The domains look like small local businesses

Microsoft shared 31 point-in-time domain indicators. Read the names. They look like landscapers, pet sitters, roofers, warehouses, and clinics. That is on purpose. You would not blink at most of these in a browser history.

aihealthring[.]com
cabinrentalsnc[.]com
chatbasedos[.]com
commercialroofingsd[.]com
dogtrainersgeorgia[.]com
fintelliganceai[.]com
homeinspectionsdelaware[.]com
intopython[.]com
lalandscapelighting[.]com
lumenagnet[.]com
marbellaresales[.]com
miamipcsupport[.]com
moldinspectiondayton[.]com
nailscanai[.]com
newjerseypetsitter[.]com
numericagent[.]com
oaklandwaterdamage[.]com
oklahomawarehousing[.]com
olympiapetemergency[.]com
peaecagent[.]com
plasmaticsystems[.]com
plethorawallet[.]com
premierrentalpurchase[.]com
ricewaterbeauty[.]com
rvieragent[.]com
sandiegotkd[.]com
secueragent[.]com
shiledagent[.]com
syracusefertilitycenter[.]com
vastbets[.]com
wvaeagent[.]com

Microsoft was clear these are point-in-time. The operators rotate hostnames. Blocking this list today is useful. It is not the whole defense. Hunt the request shapes that survive a domain change: /curl/, /dynamic?txd=, /gate?buildtxd=, macOS User-Agent strings, API-key headers, and those chunked HTTP PUT uploads.

RST Cloud already had pieces of this puzzle

This Microsoft drop builds on a May 8 analysis from RST Cloud. That team documented a static API key across four confirmed command-and-control domains and flagged 11 more candidates through repeating /dynamic?txd= and /gate?buildtxd= URI patterns. Overlapping submission windows looked like parallel C2, not a neat one-at-a-time rotation. RST Cloud put it this way: “The hex build token rotates per deployment, the api-key does not.”

Four domains now on Microsoft’s list also showed up in RST Cloud’s May candidate cluster: lalandscapelighting[.]com, lumenagnet[.]com, nailscanai[.]com, and numericagent[.]com. RST Cloud had those as URI-pattern matches, not API-key confirmed, because it had not pulled samples from each candidate. Microsoft talks about API-key headers as a recurring MacSync trait, but the August 18 post does not publish the static key RST Cloud documented, and it does not say that same value sits on every domain in the new set.

This sits next to a much bigger ClickFix web

The timing matters. Less than two weeks earlier, Microsoft said it had confirmed more than 250 front-end domains in a macOS ClickFix campaign that pushed MacSync and Atomic Stealer (AMOS) behind a server-side browser-fingerprinting gate. The August 18 report does not say those front-end domains are the same pile as these 30-plus infrastructure hosts. Do not mash the two lists together and call it done.

Apple added Terminal warnings. They will not save a busy Mac

Apple has three protections on macOS 26.4 and later: Terminal paste protection, pasteboard command blocking, and AppleScript scanning. After a 24-hour grace period from first setup, the Terminal warning can fire when the user has not opened Terminal in more than 30 days, no common developer tooling is detected, and the paste comes from something like a browser or messaging app.

That last part is the catch for a lot of people I help. If you actually use Terminal, or you have developer tools installed, you may not get the warning. XProtect can trace the process tree from a pasted command, check network artifacts against Apple’s Safe Browsing Service, and block known malware techniques. AppleScript and JavaScript for Automation also get inspected locally, including scripts run from memory. Useful. Not a substitute for not pasting garbage into Terminal in the first place.

What regular people and small shops should do

Microsoft’s advice is practical. I would treat it as the floor, not extra credit.

Do not paste or run Terminal commands from untrusted websites, chats, apps, files, or phone instructions. If a “support” page needs you to open Terminal, you are not in a support page.
Watch for odd Terminal, zsh, or shell sessions that fetch, decode, or run something right after you clicked or pasted.
If you are on the IT side, correlate AppleScript-assisted shell activity with Keychain access, zip files under /tmp, and then outbound traffic.
Monitor curl HTTP PUT uploads that use –data-binary, API-key headers, upload IDs, chunk indexes, total chunk counts, and repeating /gate URI patterns.
Check connections to new or weird domains, but keep hunting the process and request patterns after the hostnames change.

If you think a Mac already ate this, do not shrug it off. Rotate Keychain-stored passwords, browser logins, SSH keys, and any AWS or Kubernetes credentials that lived on that machine. Then get the box looked at. The operators already showed they will keep changing the storefront. Your job is to stop handing them the keys.

Primary Source: https://thehackernews.com/2026/08/microsoft-links-30-rotating-domains-to.html