MacSync Stealer: C2 Infrastructure Rotation

Reported 18 Aug 2026 by otx · Severity: medium

On 5 May 2026, a Jamf Protect deployment blocked a download attempt from jacksonvillemma[.]com, four days after the operator's previous MacSync C2 was publicly disclosed. The new C2's TLS certificate was issued within 24 hours of that disclosure. Analysis revealed a Stage 2 zsh l