Microsoft Exposes Cybercrime Network Using 30 Rotating Domains

Microsoft threat intelligence researchers have successfully linked more than 30 rotating domains to the infrastructure of MacSync Stealer. This specific malware targets macOS users to exfiltrate sensitive data, including browser credentials and cryptocurrency wallet information. The attackers utilize a rotating domain strategy to bypass traditional security filters and maintain persistent access to infected systems. By constantly shifting their command-and-control locations, the threat actors make it significantly harder for automated systems to block their activity.

The use of rotating domains highlights the increasing sophistication of malware targeting Apple’s ecosystem. MacSync Stealer often disguises itself as legitimate software or updates to trick users into granting necessary permissions. Once installed, the malware connects to the identified domains to upload stolen data and receive further instructions. Microsoft's analysis suggests that the infrastructure is highly organized, allowing the attackers to quickly replace blocked domains with new ones to ensure operational continuity.

This development is particularly relevant for the growing number of creative and tech professionals in India using macOS devices. As businesses in India increasingly adopt hybrid work environments, personal and professional data on Macs becomes a high-value target for global cybercrime syndicates. Microsoft advises users to maintain updated security software and exercise caution when downloading files from unverified sources. The discovery of these domains allows Indian IT administrators to proactively update their firewall blocklists to prevent local infections.