endpoint

Microsoft Defender Experts linked over 30 web domains to MacSync Stealer, a macOS-focused information stealer. The investigation correlated recurring endpoint and network behaviors across changing infrastructure, allowing tracking of the malware's process from payload retrieval through data collection, staging, and exfiltration.