Affected Systems

macOS systems, all versions. Primary targets: users with AWS credentials, SSH keys, Kubernetes configs, browser credentials, and Keychain data. Organizations with macOS endpoints in development, DevOps, and cloud administration roles face elevated risk.

Exploitation Status

Active exploitation confirmed. Microsoft Defender Experts observed active data exfiltration, not just beaconing. Campaign uses ClickFix social engineering to deliver payloads via Terminal commands. No named threat actor attribution published.

Business Impact

MacSync Stealer exfiltrates high-value credentials including AWS keys, SSH keys, Kubernetes configs, browser sessions, and macOS Keychain material. Compromised cloud credentials enable lateral movement into production infrastructure. Rotating domain infrastructure (30+ domains identified) complicates traditional blocklist-based defenses. Organizations relying solely on IOC blocking will face persistent exposure as attacker infrastructure changes. Apple introduced Terminal paste protections in macOS 26.4; earlier versions remain vulnerable to ClickFix social engineering vector.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block the 31 published domains at DNS/proxy layer: aihealthring[.]com, cabinrentalsnc[.]com, chatbasedos[.]com, commercialroofingsd[.]com, dogtrainersgeorgia[.]com, fintelliganceai[.]com, homeinspectionsdelaware[.]com, intopython[.]com, lalandscapelighting[.]com, lumenagnet[.]com, marbellaresales[.]com, miamipcsupport[.]com, moldinspectiondayton[.]com, nailscanai[.]com, newjerseypetsitter[.]com, numericagent[.]com, oaklandwaterdamage[.]com, oklahomawarehousing[.]com, olympiapetemergency[.]com, peaecagent[.]com, plasmaticsystems[.]com, plethorawallet[.]com, premierrentalpurchase[.]com, ricewaterbeauty[.]com, rvieragent[.]com, sandiegotkd[.]com, secueragent[.]com, shiledagent[.]com, syracusefertilitycenter[.]com, vastbets[.]com, wvaeagent[.]com
  • Deploy behavioral detection for MacSync patterns: monitor curl HTTP PUT requests with API-key headers and parameters upload_id, chunk_index, total_chunks; alert on /curl/, /dynamic?txd=, /gate?buildtxd= URI paths; detect archive creation under /tmp/sync* and /tmp/osalogging.zip
  • Hunt for compromise indicators: search macOS endpoint logs for zsh/Terminal sessions followed by curl retrieval, Base64/gunzip decoding, osascript execution, and Keychain access within short time windows; investigate outbound HTTP PUT traffic with chunked upload parameters
  • Upgrade macOS fleet to version 26.4 or later to enable Terminal paste protection, pasteboard command blocking, and AppleScript scanning via XProtect
  • Implement user awareness training focused on ClickFix social engineering: instruct users never to paste Terminal commands from websites, chat apps, or phone-based tech support; emphasize that legitimate vendors do not request Terminal command execution