Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

Microsoft has identified over 30 rotating domains linked to the MacSync Stealer malware. The malware targets Mac users, stealing passwords and sensitive data. The domains are used to distribute fake installation guides for Claude, a popular AI assistant. These guides trick users into installing malware that turns trusted crypto wallet apps into phishing traps.

Microsoft's approach to combating the malware focuses on tracking its behavior rather than blocking individual domains. This method allows the company to disrupt the malware's operations more effectively. The Hacker News and CyberSecurityNews have covered the story. Microsoft's own blog post details the company's behavioral tracking strategy.

TechRadar has also covered Microsoft's new approach. The malware remains active. Users are advised to be cautious when downloading installation guides for AI assistants or other software. Microsoft's behavioral tracking method may help mitigate the threat, but the specific domains involved are constantly changing.