type: incident · created: 2026-08-20 · updated: 2026-08-20 · tags: [incident, infostealer, macos, clickfix, microsoft] · confidence: high · affected_sectors: [technology] · au_impact: true
🎯 IOCs · MacSync
Indicators of compromise · MacSync — 4 shown
hxxps://injurylawsocal[.]com/curl/b3433043648ae2e6cae272bd911ef1d0e66baf4dd0a8cd43e271793bd6465144injurylawsocal[.]combef7f2a722bf846bc291fc68257e74e0a54384305d259160c607a9cd8daac9580e01d720a0e545e363736bd9b7fc7df142aadcf7550ffc001f0633f8ac718a8e
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Microsoft Ties 30+ Rotating Domains to MacSync Stealer Infrastructure
Microsoft Defender for Endpoint correlated more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, tracing payload retrieval, staging and exfiltration over rotating infrastructure.
| Attribute | Detail |
|---|---|
| Actor infra | 30+ rotating web domains (MacSync stealer) |
| Execution | Interactive Terminal sessions consistent with ClickFix social engineering |
| Payload chain | curl + native macOS utilities to retrieve/unpack payloads |
| Source | Microsoft (via BleepingComputer) — Tier 2/4 |
The campaign uses ClickFix social engineering to lure macOS users into running curl/native-command payloads, with rotating domain infrastructure to resist takedown.