MacSync malware abuses public iCloud calendar for delivery

MacSync malware abuses public iCloud calendar for delivery, Kaspersky researchers report. The macOS info-stealing malware has adopted a new distribution chain that hides commands inside the description of a public iCloud calendar event. When the victim's Mac processes that calendar data, those hidden commands fetch the next stage of malware from iCloud itself.

MacSync is a Swift-based malware family that first appeared in April 2025. Kaspersky notes that early versions were derived from the AMOS stealer family, a known macOS threat. Over time, MacSync evolved and added new capabilities through separate modules. The malware has been distributed through social engineering, including ClickFix-style attacks, in which fake error messages or software prompts trick users into running malicious commands. Recently, MacSync has been observed in ClickFix campaigns disguised as Homebrew, a popular package manager for macOS, and as a macOS disk space analyzer tool. The threat actor also presented the malware as a fake cryptocurrency wallet called Toria, which had its own website and was promoted on social media platforms.

The Kaspersky team identified two delivery methods in the latest MacSync campaign. In the more complex one, a downloader reads commands hidden in the description of a public iCloud calendar event. The downloader feeds the calendar text to macOS's zsh shell, a command-line program where typed commands run. Most of the calendar text simply produces errors, but commands placed after the event's DESCRIPTION line are executed. Those commands download an archive containing the malware components from iCloud. The archive holds an APP bundle, a packaged Mac application, that acts as a dropper, a small program that installs other malware. The dropper then leads through additional stages until the MacSync malware itself is retrieved.

The core info-stealer module remains largely unchanged from earlier versions. It targets browser history, cookies, and saved credentials. It also tries to collect data from cryptocurrency wallet browser extensions and apps, Telegram, the macOS Keychain file, system and device information, and configuration files for SSH, AWS, Kubernetes, Git, and the shell. In other words, it looks for anything a user might have stored on the Mac that could be valuable for account takeover or further network access.

The new module observed by Kaspersky is an Objective-C backdoor, a hidden way for an attacker to control a computer without the owner's knowledge. It disguises itself as Finder, the default file manager on macOS. Its installer establishes persistence through a LaunchAgent, a macOS mechanism for automatically starting programs, changes to the .zshrc configuration file, and global Git hooks, which are scripts that run automatically during Git operations. It also terminates macOS notification processes so that the user does not receive alerts about the infection.

The backdoor can perform several actions. It can run AppleScript, a scripting language built into macOS, that is supplied by the attacker's command-and-control (C2) server, which is the computer used to send instructions to infected devices. It can deploy a browser extension or replace an installed Ledger wallet application with a version supplied by the C2 server. It can collect additional system information and files and upload them to the C2 server. It can also check and re-establish its persistence so that it starts again after a reboot. Kaspersky inferred the purpose of these commands from their names and status messages because the researchers did not have the AppleScript code the commands would run.

The researchers also identified a 'mystery' command named live_browser. It downloads and executes a component called sn_relay, but Kaspersky could not determine what sn_relay does.

Because the distribution chain relies on users running commands they find online or opening files from untrusted sources, Kaspersky advises macOS users not to execute commands they find online, to avoid downloading DMG files from suspicious websites, and to treat admin password prompts with caution. A DMG is Apple's disk image format commonly used to distribute Mac software. These steps are especially important for people who manage websites or cloud services from a Mac, because stolen SSH, AWS, Git, or hosting credentials can quickly lead to a site compromise. For businesses that run macOS endpoints alongside web infrastructure, AEU-I's security-first IT and consulting services can help review endpoint protections and credential handling before a device-level infection turns into a larger compromise.