Cybersecurity
MacSync uses public iCloud calendars to deliver payloads
Kaspersky said a MacSync campaign hid commands in public iCloud calendar descriptions to fetch payloads, while a new Objective-C backdoor added persistence, remote execution and data theft functions.
- Kaspersky said MacSync was a Swift-based info-stealing malware family that first appeared in April 2025.
- The researchers said one delivery chain used a public iCloud calendar event to hide commands and fetch the next-stage payload.
- Kaspersky said the archive contained an APP bundle that acted as a dropper for later stages.
- The new module was an Objective-C backdoor that used a LaunchAgent, .zshrc changes and global Git hooks for persistence.
- Kaspersky said the backdoor could run attacker-supplied AppleScript, install or replace a browser extension or Ledger wallet app, and collect more system data.
Kaspersky said one campaign used public iCloud calendar events to move instructions and payloads onto infected Macs. The downloader passed the retrieved calendar text to zsh, and commands placed after the DESCRIPTION line fetched an archive from iCloud.
That archive contained an APP bundle that acted as a dropper and led to further stages that recovered the MacSync malware. Kaspersky said MacSync had also been spread through social engineering, including ClickFix-style lures and software presented as free, cracked, or new applications.
The researchers said the infostealer still targeted browser history, cookies, saved credentials, wallet extension data, Telegram data, the Keychain file, system details, SSH, AWS, Kubernetes, Git and shell configuration files. They said the new module was an Objective-C backdoor that pretended to be Finder and used a LaunchAgent, .zshrc changes and global Git hooks to keep running.
Kaspersky said the backdoor could run AppleScript from its command-and-control server, deploy a browser extension or replace an installed Ledger wallet app, and upload files and system information. The company said it inferred some command purposes from names and status messages because it did not have the AppleScript code, and it could not determine what the live_browser command and sn_relay component did.
Named in this story
Companies
- Kaspersky
- the researchers who analysed the campaign and described its delivery chain
Products and systems
- MacSync
- the malware family that delivered the campaign and added a new backdoor module
- iCloud
- the service that hosted the public calendar event used to hide commands
- macOS
- the platform targeted by the malware
- AMOS
- the earlier stealer family MacSync had been derived from
- Homebrew
- one of the tools the malware had been disguised as in ClickFix campaigns
- Finder
- the macOS file manager the backdoor mimicked
- Toria
- the fake crypto wallet used as a lure in the campaign
How the source tells it
The article was a straightforward technical security report with a short advisory ending and no sustained emotive framing.
No emotive framing was found in the original.