MacSync malware uses public iCloud calendars to deliver new payloads
The macOS threat landscape has witnessed a significant escalation in sophistication with the emergence of a new delivery mechanism for the MacSync info-stealing malware. Security researchers at Kaspersky have identified a campaign in which threat actors leverage public iCloud calendar events to host malicious instructions. This development marks a shift in how Mac-targeted malware bypasses traditional security perimeters, utilizing legitimate, trusted infrastructure to distribute multi-stage payloads. By hiding command-and-control (C2) directives within the metadata of calendar descriptions, attackers are increasingly adept at evading signature-based detection systems that typically monitor for unauthorized external network connections.
The Evolution of MacSync: From AMOS Origins to Advanced Stealth
MacSync first surfaced in April 2025 as a Swift-based infostealer. Initially, it was identified by security analysts as a derivative of the Atomic macOS Stealer (AMOS) family, a well-known strain of malware that has plagued Apple users for years. However, while early iterations relied on standard obfuscation and distribution techniques, the latest versions represent a modular evolution. The malware is no longer just a static data-gathering tool; it has transformed into a persistent, multi-stage threat capable of adapting to the user’s environment in real-time.
The core functionality of the stealer remains robust, focusing on the exfiltration of sensitive data from browsers, including history, cookies, and saved passwords. Furthermore, it targets cryptocurrency wallet data, Telegram local storage, Keychain files, and various configuration files associated with developer tools like SSH, AWS, Kubernetes, and Git. This comprehensive targeting profile suggests that the operators are not merely looking for casual consumer data but are actively seeking high-value access to corporate and developer infrastructure.
The iCloud Calendar Delivery Mechanism
The most notable innovation in this campaign is the use of public iCloud calendars as a conduit for infection. In the observed attack vector, victims are typically lured via social engineering, often involving "ClickFix" campaigns—a tactic that tricks users into copying and pasting commands into their terminal under the guise of fixing a software display issue or a disk space error.
Once the initial downloader is executed, it does not immediately pull the malicious payload from a suspicious third-party server. Instead, it queries a public iCloud calendar event. The description field of this event contains encoded shell commands. When the downloader fetches this data and passes it to the macOS zsh shell, the system treats the malicious text as a legitimate instruction. Because the calendar is hosted on Apple’s own infrastructure, these network requests are less likely to trigger automated security alerts.
The process is highly surgical. While the majority of the text within the calendar event appears as innocuous junk data, the specific string following the "DESCRIPTION:" tag contains the command required to download the next-stage payload. This payload is an archive containing an APP bundle, which serves as a dropper for the full MacSync malware. This layered approach ensures that even if one component is discovered and blocked, the infection chain remains difficult to fully dismantle.
A Chronology of the Campaign
The progression of MacSync illustrates the rapid pace at which threat actors refine their operations to maintain persistent access.
- April 2025: MacSync is first identified, largely mirroring the capabilities of the AMOS stealer family.
- Mid-2025: Researchers observe MacSync being integrated into ClickFix-style social engineering attacks, often masquerading as Homebrew installers or system utility tools.
- Late 2025: The threat actors experiment with high-profile lures, including the creation of a fake cryptocurrency wallet platform named "Toria," complete with a professional-looking website and social media promotion.
- 2026: The adoption of iCloud calendar events for payload delivery is documented, marking a departure from traditional C2 infrastructure.
- September 2026: The emergence of a new Objective-C backdoor module, disguised as the native macOS Finder application, is confirmed by Kaspersky.
Analysis of the Objective-C Backdoor Module
Beyond the information-stealing components, the latest iteration of MacSync introduces a sophisticated Objective-C backdoor. Unlike the main stealer, which is designed to grab data and move on, this backdoor is designed for long-term presence. It establishes persistence by modifying .zshrc files and installing a LaunchAgent, ensuring it executes every time the user logs in.
To maintain stealth, the backdoor actively monitors for and terminates macOS notification processes. This prevents the user from receiving system alerts that might indicate unusual activity or the installation of unauthorized software. The module also implements global Git hooks, which allow the attackers to intercept or monitor development workflows.
Perhaps most concerning is the discovery of the "live_browser" command. This function downloads and executes a component identified as "sn_relay." While researchers have been unable to fully decompile the relay’s purpose due to missing AppleScript code in the captured samples, its existence suggests a capability for real-time interaction with the infected system. The use of AppleScript is particularly telling, as it allows the malware to interact with the GUI and other applications in ways that typical shell-based malware cannot, potentially enabling attackers to bypass biometric authentication prompts or perform "mouse-jacking" style actions.
Broader Implications for macOS Security
The shift toward abusing legitimate cloud services like iCloud, Google Drive, or Discord for malware delivery represents a significant challenge for enterprise security teams. Traditional perimeter security, which relies on blacklisting known malicious domains, is largely ineffective when the delivery mechanism is a trusted, white-listed service.
Furthermore, the rise of ClickFix campaigns highlights the vulnerability of the "human element" in modern cybersecurity. Despite Apple’s implementation of Gatekeeper and XProtect, attackers have found that they do not need to break the system’s integrity if they can convince the user to lower the defenses themselves. By guiding victims to copy-paste commands into the terminal, attackers effectively bypass the OS’s built-in protections, as the user is authorizing the execution of the code.
Strategic Defensive Recommendations
For both individual users and organizations, the evolution of MacSync mandates a change in security posture. Security experts emphasize the following defensive measures:
- Strict Adherence to Software Sources: Users should exclusively download applications from the Mac App Store or directly from the official websites of verified developers. Avoiding third-party "cracked" software sites or promotional links on social media is the most effective deterrent.
- Caution with Terminal Commands: Under no circumstances should users copy and paste commands from websites, forums, or social media, even if those instructions are presented as "fixes" for system errors. If an issue exists, users should follow official support documentation provided by Apple.
- Authentication Hygiene: Be wary of administrative password prompts. Malware often relies on social engineering to trick users into providing authorization for malicious background processes. If an unexpected prompt appears, it should be denied, and the system should be audited for recent installations.
- Endpoint Monitoring: Organizations should employ Endpoint Detection and Response (EDR) solutions that monitor for anomalous process behavior, such as a shell script interacting with non-standard web services or unexpected modifications to configuration files like .zshrc or LaunchAgents.
As MacSync continues to iterate, the security community remains vigilant. The transition to more evasive, multi-stage payloads suggests that the actors behind this malware are well-resourced and capable of rapid adaptation. The primary challenge for defenders in the coming months will be to improve detection at the behavioral level, focusing on the "how" of the attack rather than the "where." As long as users remain the target, the combination of sophisticated technical backdoors and psychological manipulation will continue to be a potent weapon in the arsenal of modern cyber-criminal organizations.
