Microsoft Publishes Detailed Threat Hunting Guidance for MacSync Stealer Infrastructure

Microsoft has published detailed threat intelligence on MacSync Stealer, a macOS-focused information stealing malware that rapidly rotates domains to evade detection. The Microsoft Security Blog explains that while the malware's infrastructure changes frequently, its underlying behaviour remains consistent, allowing threat hunters to identify related domains through behavioural pivots rather than relying solely on known indicators of compromise. Microsoft's analysis uncovered more than 30 related domains by focusing on patterns such as SSL certificate characteristics, hosting provider choices, domain registration timing and HTTP response behaviours. The research demonstrates how durable hunting techniques can track threat actor infrastructure even when individual indicators change daily. MacSync Stealer targets credentials, browser data and cryptocurrency wallets on macOS systems, often delivered through malicious software bundles or fake application updates. The malware is designed to exfiltrate data quickly and quietly, often before traditional endpoint security tools can detect and respond to the threat.

Why this matters for UK organisations

For UK organisations, this research is valuable not just for the specific threat actor but for the methodology it demonstrates. Many organisations rely heavily on static indicators of compromise, which become obsolete as soon as attackers rotate infrastructure. Behavioural threat hunting, by contrast, focuses on the patterns and choices threat actors make when building and operating their infrastructure. This approach is particularly relevant for organisations managing macOS fleets, which are increasingly targeted by information stealers as adoption grows in enterprise environments. The research also highlights the importance of monitoring for credential theft and exfiltration activity on endpoints, particularly where users have access to sensitive systems, cloud platforms or financial services. MacOS deployments are often less rigorously managed than Windows environments, with fewer organisations applying the same level of endpoint security, monitoring and patch management. This creates opportunities for attackers to target high-value users, including executives, developers and finance teams, who often use macOS devices and have access to sensitive data and privileged accounts.

What to review

Consider whether your organisation's threat detection and hunting capabilities rely too heavily on static indicators, and whether there is capacity to identify threats through behavioural patterns. For organisations with macOS deployments, review endpoint security coverage, credential management practices and monitoring for data exfiltration activity, particularly where users access cloud services or store sensitive information locally. Organisations should also evaluate whether macOS devices are subject to the same security policies, patch management and monitoring as Windows devices, and whether there is visibility into what software is being installed and what data is being accessed or exfiltrated. Consider implementing application control, monitoring for unusual network activity and ensuring that credentials are protected using multi-factor authentication, password managers and regular rotation. Where users have access to sensitive systems or privileged accounts, consider whether additional monitoring, logging and alerting is in place to detect credential theft or misuse.

Source: Microsoft Security Blog