Microsoft smothers malware by tracking behavior instead of blocking domains

Malware.

• Microsoft says blocking domains is ineffective against MacSync Stealer’s evolving infrastructure
• Defender experts tracked over 30 domains by analyzing behavioral patterns instead
• Mitigation focuses on spotting suspicious shell sessions, osascript activity, and /tmp/sync archives

Microsoft says it has found a way to stop the dangerous MacSync Stealer malware by monitoring certain behaviors, rather than keeping track of the domains used in the attacks.