Microsoft Smothers Malware by Tracking Behavior Instead of Blocking Domains

Microsoft smothers malware by tracking behavior instead of blocking domains

Microsoft says blocking domains is ineffective against MacSync Stealer’s evolving infrastructureDefender experts tracked over 30 domains by analyzing behavioral patterns insteadMitigation focuses on spotting suspicious shell sessions, osascript activity, and /tmp/sync archivesMicrosoft says it has found a way to stop the dangerous MacSync Stealer malware by monitoring certain behaviors, rather than keeping track of the domains used in the attack…

MacSync Stealer Hides Behind 30+ Domains While Stealing Passwords and Sensitive Mac Data

MacSync Stealer is expanding the risk facing Mac users by turning everyday web browsing and Terminal activity into a route for password theft. The macOS-focused malware uses short-lived online infrastructure, making simple blocklists less effective and leaving victims exposed to account theft, financial loss, and disclosure of private files. The campaign begins with ClickFix social engineering. A victim is persuaded to paste a command into Termi…

Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains

Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains Pierluigi Paganini August 19, 2026 Microsoft tracked over 30 MacSync Stealer domains by focusing on behavioral patterns, revealing a campaign targeting passwords, keys, wallets and other data. Domain blocking is a losing game when the thing you’re blocking can register a new domain faster than you can add it to a list. That’s the exact problem Microsoft Defender Ex…

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors across changing infrastructure, tracing the malware from payload retrieval through data collection, staging, and exfiltration. The tech giant said it required multiple endpoint and network behaviors to align before

Hunting MacSync Stealer infrastructure through behavioral pivots

MacSync Stealer rapidly rotates domains to evade detection, but its behavior remains consistent. Learn how Microsoft uncovered 30+ related domains using durable hunting pivots. This article has been indexed from Microsoft Security Blog Read the original article: Hunting MacSync Stealer infrastructure through behavioral pivots The post Hunting MacSync Stealer infrastructure through behavioral pivots appeared first on IT Security News.