Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

Microsoft Defender Experts have connected over 30 web domains to the MacSync Stealer, a malware that targets macOS systems to steal information. The experts made this connection by analyzing repeated patterns of behavior on endpoints and networks, despite the infrastructure constantly changing. This analysis followed the malware's activity from retrieving its payload to collecting and staging data, and finally to exfiltrating it. The investigation required the alignment of multiple behaviors across endpoints and networks to confirm the link. Microsoft's findings highlight the dynamic nature of the MacSync Stealer's infrastructure. The company's experts were able to trace the malware's activity across its entire lifecycle.