The malware targets passwords, browser credentials, authentication cookies, macOS Keychain material, SSH keys, cloud access credentials, cryptocurrency wallets and sensitive files stored on compromised machines. Its operators repeatedly replace command-and-control infrastructure, making individual domain blocklists less effective while preserving behaviours that defenders can track across successive deployments.

MacSync commonly reaches victims through ClickFix-style social engineering. Users encounter deceptive websites or advertisements that tell them to copy a command and paste it into macOS Terminal, often presenting the instruction as a software installation or troubleshooting step. The command retrieves malicious content with the legitimate curl utility and starts a script-driven infection chain without requiring the victim to launch a conventional unsigned application.

The technique reflects a wider shift among macOS information stealers towards abuse of trusted system utilities rather than dependence on executable files that security products can more easily identify. Similar campaigns have used malicious disk images, fraudulent installers and advertisements impersonating legitimate software, particularly tools likely to appeal to developers and technology users.

Once executed, MacSync uses shell processes and AppleScript-assisted commands to gather information about the machine and its user. Collection can include passwords and credentials stored by web browsers, browser cookies and session information, Keychain data, Apple Notes, browsing history, Telegram information and files from commonly used directories.

Developer environments are an especially valuable target. MacSync has been observed searching for SSH credentials, Amazon Web Services access material and Kubernetes configuration files. Theft of these credentials potentially extends a compromise beyond an individual Mac because valid developer or administrator keys can provide access to source-code repositories, servers, cloud services and production infrastructure.

Cryptocurrency data is another prominent target. MacSync-related payloads have searched for desktop wallets, browser wallet extensions and other cryptocurrency material. More advanced variants examined during the campaign have also displayed capabilities associated with persistent remote access and attempts to interfere with wallet applications, increasing the potential impact beyond straightforward password collection.

Collected material is typically copied into temporary staging directories with names beginning /tmp/sync. The malware then creates an archive, including observed use of /tmp/osalogging. zip, before splitting stolen material into chunks for transmission.

Exfiltration takes place through curl using HTTP PUT requests. Repeated parameters including uploadid, chunkindex and total_chunks allow the attacker to organise multipart uploads while providing defenders with behavioural indicators that remain useful even when destination domains change. API-key headers, recurring request paths and characteristic command-line options provide additional signals.

Infrastructure rotation has become one of MacSync’s defining operational features. An investigation published in May found that one command-and-control domain had been replaced within days of public exposure. A new TLS certificate was issued roughly a day after the earlier infrastructure was disclosed, and the replacement server was soon attempting to deliver malicious content.

Investigators subsequently connected multiple confirmed domains through a common API key and recurring URI structures. Additional infrastructure dating back to at least February 2026 was identified through those patterns. Broader telemetry analysis has now associated more than 30 domains with behaviour matching the campaign.

That infrastructure includes domains whose names resemble legitimate services, local businesses, software products and technology projects. Such naming helps malicious servers appear less conspicuous in basic network logs while allowing operators to abandon exposed domains and activate replacements.

The campaign illustrates the declining durability of domain-based indicators in fast-moving malware operations. Blocking an identified server can disrupt an individual infection path, but attackers able to register and deploy replacement domains can restore operations quickly.

Defensive attention is therefore shifting towards correlations between endpoint and network behaviour. Interactive Terminal sessions followed by unusual curl commands, AppleScript execution, credential-store access, temporary archive creation and immediate outbound uploads together produce a stronger signal than any single domain name.

Administrators can also monitor macOS systems for abnormal access to Keychain data, browser credential databases, SSH directories, AWS files and Kubernetes configurations. HTTP PUT requests containing chunk-management parameters or unusual API-key headers can provide another opportunity to identify exfiltration.

The malware targets passwords, browser credentials, authentication cookies, macOS Keychain material, SSH keys, cloud access credentials, cryptocurrency wallets and sensitive files stored on compromised machines. Its operators repeatedly replace command-and-control infrastructure, making individual domain blocklists less effective while preserving behaviours that defenders can track across successive deployments.

MacSync commonly reaches victims through ClickFix-style social engineering. Users encounter deceptive websites or advertisements that tell them to copy a command and paste it into macOS Terminal, often presenting the instruction as a software installation or troubleshooting step. The command retrieves malicious content with the legitimate curl utility and starts a script-driven infection chain without requiring the victim to launch a conventional unsigned application.

The technique reflects a wider shift among macOS information stealers towards abuse of trusted system utilities rather than dependence on executable files that security products can more easily identify. Similar campaigns have used malicious disk images, fraudulent installers and advertisements impersonating legitimate software, particularly tools likely to appeal to developers and technology users.

Once executed, MacSync uses shell processes and AppleScript-assisted commands to gather information about the machine and its user. Collection can include passwords and credentials stored by web browsers, browser cookies and session information, Keychain data, Apple Notes, browsing history, Telegram information and files from commonly used directories.

Developer environments are an especially valuable target. MacSync has been observed searching for SSH credentials, Amazon Web Services access material and Kubernetes configuration files. Theft of these credentials potentially extends a compromise beyond an individual Mac because valid developer or administrator keys can provide access to source-code repositories, servers, cloud services and production infrastructure.

Cryptocurrency data is another prominent target. MacSync-related payloads have searched for desktop wallets, browser wallet extensions and other cryptocurrency material. More advanced variants examined during the campaign have also displayed capabilities associated with persistent remote access and attempts to interfere with wallet applications, increasing the potential impact beyond straightforward password collection.

Collected material is typically copied into temporary staging directories with names beginning /tmp/sync. The malware then creates an archive, including observed use of /tmp/osalogging. zip, before splitting stolen material into chunks for transmission.

Exfiltration takes place through curl using HTTP PUT requests. Repeated parameters including uploadid, chunkindex and total_chunks allow the attacker to organise multipart uploads while providing defenders with behavioural indicators that remain useful even when destination domains change. API-key headers, recurring request paths and characteristic command-line options provide additional signals.

Infrastructure rotation has become one of MacSync’s defining operational features. An investigation published in May found that one command-and-control domain had been replaced within days of public exposure. A new TLS certificate was issued roughly a day after the earlier infrastructure was disclosed, and the replacement server was soon attempting to deliver malicious content.

Investigators subsequently connected multiple confirmed domains through a common API key and recurring URI structures. Additional infrastructure dating back to at least February 2026 was identified through those patterns. Broader telemetry analysis has now associated more than 30 domains with behaviour matching the campaign.

That infrastructure includes domains whose names resemble legitimate services, local businesses, software products and technology projects. Such naming helps malicious servers appear less conspicuous in basic network logs while allowing operators to abandon exposed domains and activate replacements.

The campaign illustrates the declining durability of domain-based indicators in fast-moving malware operations. Blocking an identified server can disrupt an individual infection path, but attackers able to register and deploy replacement domains can restore operations quickly.

Defensive attention is therefore shifting towards correlations between endpoint and network behaviour. Interactive Terminal sessions followed by unusual curl commands, AppleScript execution, credential-store access, temporary archive creation and immediate outbound uploads together produce a stronger signal than any single domain name.

Administrators can also monitor macOS systems for abnormal access to Keychain data, browser credential databases, SSH directories, AWS files and Kubernetes configurations. HTTP PUT requests containing chunk-management parameters or unusual API-key headers can provide another opportunity to identify exfiltration.