Hunting MacSync Stealer infrastructure through behavioral pivots

**Executive summary:** Microsoft Defender Experts analyzed MacSync Stealer, a macOS information-stealing malware that leverages user-pasted Terminal commands (ClickFix social engineering), curl-based payload delivery, AppleScript-assisted execution, broad credential and file collection (Keychain, browser stores, SSH, cloud creds, user files), staging under /tmp paths, chunked HTTP PUT exfiltration with API-key headers and upload_id/chunk_index/total_chunks parameters, and rapidly rotating web infrastructure; the report provides behavioral pivots, >30 related domains as point-in-time IOCs, MITRE ATT&CK mappings, hunting queries, and recommended mitigations to detect and disrupt the activity.