[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffwAdFEufRofZNWyzaOC_FcP7awRzh4yhNXf76jDnzs0":3},{"article":4,"iocs":38,"watch_terms":42,"solutions":43,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"af159448-8924-4a18-8f7c-dff305d82c6e","Hunting MacSync Stealer infrastructure through behavioral pivots","hunting-macsync-stealer-infrastructure-through-behavioral-pivots-cd63a9","MacSync Stealer rapidly rotates domains to evade detection, but its behavior remains consistent. Learn how Microsoft uncovered 30+ related domains using durable hunting pivots. The post Hunting MacSync Stealer infrastructure through behavioral pivots appeared first on Microsoft Security Blog.","Microsoft Threat Intelligence has identified the MacSync Stealer malware, which employs a strategy of rapidly rotating domains to evade detection. Despite this, the malware's underlying behavior remains consistent, allowing Microsoft to uncover over 30 related domains through durable hunting pivots. This analysis highlights the persistent threat of macOS-targeting malware and the methods used to track its infrastructure.","Microsoft uncovered 30+ MacSync Stealer domains using behavioral pivots.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F08\u002F18\u002Fhunting-macsync-stealer-infrastructure-through-behavioral-pivots\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002FMS_Actional-Insights_Links.jpg","2026-08-18T17:08:28+00:00","2026-08-18T20:00:27.430155+00:00",7,[17],{"name":18,"type":19},"Microsoft","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39],{"type":24,"value":40,"context":41},"MacSync Stealer","Identified malware family",[18],{"controls":44,"vendors":129},[45,74,102],{"slug":46,"name":47,"problem":48,"products":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":37,"name":75,"problem":76,"products":77},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":103,"name":104,"problem":105,"products":106},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":124,"product_name":125,"url":127,"description":128},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",[130],{"slug":131,"name":18,"logo_path":132,"roles":133},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[134],"reported_by",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":151},"macsync-stealer-uses-rotating-domains-to-evade-detection-on-macos","MacSync Stealer Uses Rotating Domains to Evade Detection on macOS","MacSync Stealer demonstrates how adversaries leverage rapid domain rotation to frustrate traditional indicator-based defenses, making static blocklists quickly obsolete. Despite rotating infrastructure, the malware's consistent behavioral patterns — such as C2 communication sequences and DNS query behaviors — allowed Microsoft to pivot and uncover over 30 related domains, underscoring the value of behavioral threat hunting over purely signature-based detection. This incident highlights a growing and often underestimated threat surface: macOS endpoints, which many organizations assume to be inherently safer than Windows systems. Organizations that rely solely on known-bad indicators without investing in behavioral analytics and durable hunting logic are particularly exposed to this class of threat.",[140,141,142,143,144,145,146,147,148,149,150],"CIS Control 7: Continuous Vulnerability Management","CIS Control 8: Audit Log Management","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide","NIST SP 800-83: Guide to Malware Incident Prevention and Handling","NIST DE.CM-1: Network monitoring to detect cybersecurity events","NIST DE.AE-2: Detected events are analyzed to understand attack targets and methods","MITRE ATT&CK T1568: Dynamic Resolution (Domain Generation \u002F Fast Flux)","MITRE ATT&CK T1041: Exfiltration Over C2 Channel","ITIL: Event Management \u002F Problem Management practices",{}]