Breaking
Bursa ends lower, selected sectors gain after 6% Q2 GDP growthStudent loan abolition plan unveiled by PKR Youth chiefKDM’s withdrawal from GRS risks loss of power, say analystsUSS Abraham Lincoln’s record deployment sparks US lawmaker probe into Navy readinessOut of ammo: Pentagon urged to buy fast, cheap weapons to plug China gapUS national debt tops GDP for first time since World War IIMalaysia CISOs urged to hunt MacSync Stealer via behavioral pivotsChargEV offers RM10 voucher to referee, 50% discount to referrerApple’s next AirPods to include built-in cameras for Visual IntelligenceMeta referred to court, accused of concealing platform risks to teensBritish newlyweds die in Greece helicopter crash on honeymoonPhilippines open to scrapping some taxes to ease consumer burdenFrom data to policy: Building Africa’s evidence ecosystem for better tax reformIMF pushes for beneficial ownership transparency in new AML guidanceFBM KLCI ends three-day losing streak as banking shares reboundHong Kong’s 5-year plan consultation has sparked valuable discussionsClop builds custom web shell for Windchill servers in data theft campaignTop Chef turns to tears as host Kristen Kish redefines the roleMicrosoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected AppsMLflow flaw exploited to steal cloud credentialsBursa ends lower, selected sectors gain after 6% Q2 GDP growthStudent loan abolition plan unveiled by PKR Youth chiefKDM’s withdrawal from GRS risks loss of power, say analystsUSS Abraham Lincoln’s record deployment sparks US lawmaker probe into Navy readinessOut of ammo: Pentagon urged to buy fast, cheap weapons to plug China gapUS national debt tops GDP for first time since World War IIMalaysia CISOs urged to hunt MacSync Stealer via behavioral pivotsChargEV offers RM10 voucher to referee, 50% discount to referrerApple’s next AirPods to include built-in cameras for Visual IntelligenceMeta referred to court, accused of concealing platform risks to teensBritish newlyweds die in Greece helicopter crash on honeymoonPhilippines open to scrapping some taxes to ease consumer burdenFrom data to policy: Building Africa’s evidence ecosystem for better tax reformIMF pushes for beneficial ownership transparency in new AML guidanceFBM KLCI ends three-day losing streak as banking shares reboundHong Kong’s 5-year plan consultation has sparked valuable discussionsClop builds custom web shell for Windchill servers in data theft campaignTop Chef turns to tears as host Kristen Kish redefines the roleMicrosoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected AppsMLflow flaw exploited to steal cloud credentials
Economy

Malaysia CISOs urged to hunt MacSync Stealer via behavioral pivots

MacSync Stealer operators use fast-rotating domains but leave durable traces in URI paths, User-Agent strings and chunked upload parameters, Microsoft Defender Experts said.

Source: Microsoft Security Blog · August 18, 2026 at 11:41 PM · AI-assisted report

Single-source
Malaysia CISOs urged to hunt MacSync Stealer via behavioral pivots
Photo: Tyler Lahti / CC BY-SA 4.0

KUALA LUMPUR, 19 AUGUST 2026 —

Listen to this article

DomainFork Audio · read aloud

MacSync Stealer operators use fast-rotating domains but leave durable traces in URI paths, User-Agent strings and chunked upload parameters, Microsoft Defender Experts said.

Market Impact

Microsoft’s threat hunters found the malware relies on ClickFix-style social engineering to trick users into pasting attacker-controlled shell commands that fetch and run further scripts. Once executed, the payload collects macOS Keychain data, browser credentials and sensitive files before staging them in /tmp/sync* paths, compressing to osalogging.zip, splitting into chunks and uploading via HTTP PUT with curl’s --data-binary flag.

The same behavioral chain—shell execution, recurring URI patterns such as /curl/ and /gate?buildtxd=, macOS User-Agent headers, API-key values and upload_id / chunk_index parameters—connects more than 30 domains despite rapid infrastructure turnover.

The investigation traced the activity from payload retrieval through command-and-control check-ins to active exfiltration, using endpoint and network telemetry to establish durable pivots. RST Cloud had earlier flagged a limited set of domains, but Microsoft’s correlation extended coverage by linking execution context with network request shape. Repeated curl command-line options—-k, -s, --max-time and --data-binary—alongside static API-key headers and consistent staging locations gave defenders repeatable ways to hunt the threat even when domains changed.

The attack chain is fast and script-driven, starting with a zsh terminal session, using osascript to blend AppleScript with Unix commands, then quickly moving to sensitive data collection and exfiltration. Microsoft noted hunting value in correlating user-facing shell activity with later network transfers and cleanup steps. After upload, the malware removes temporary files, but the sequence of archive creation, chunked transfer and deletion remains observable.

Apple’s macOS 26.4 update introduced defenses against ClickFix-style attacks by warning users who paste terminal commands and by extending XProtect coverage to block detected malicious scripts. Microsoft recommends macOS users and CISOs prioritise endpoint monitoring for the behavioral patterns Microsoft disclosed, including the recurring URI paths, curl options and upload parameters, and to deploy Microsoft Defender XDR detections where provisioned.

Related: Microsoft

Reporting based on Microsoft Security Blog. Figures and claims are subject to revision as the story develops. DomainFork publishes editorial context, not investment advice — see our editorial standards.