A recently observed MacSync malware campaign is using publicly accessible iCloud calendar events as part of its payload delivery process, according to research from Kaspersky. The Swift-based macOS threat, first identified in 2025, is an information stealer that has expanded beyond its earlier links to the Atomic macOS Stealer (AMOS) family with additional modular components.
MacSync has been distributed through social-engineering schemes, including ClickFix-style lures that pose as legitimate tools such as Homebrew installers or disk-space utilities. Researchers also found it promoted as a purported cryptocurrency wallet named Toria through a dedicated website and social-media activity. Other delivery attempts have involved software advertised as free, cracked, or newly released applications.
Calendar-based command retrieval
In one of the newer infection chains, an initial downloader retrieves content from the description field of a public iCloud calendar event. It passes the data to the macOS zsh shell. Although much of the calendar content causes errors when interpreted as shell input, commands placed after the event description marker can execute and retrieve a malicious archive from iCloud.
The downloaded archive includes an application bundle that functions as a dropper and launches subsequent stages, eventually installing the MacSync payload. Using legitimate cloud-hosted services for command or payload retrieval can make malicious infrastructure more difficult to identify and block.
Backdoor capability added
The core stealing functionality reportedly continues to target browser data, saved credentials, cryptocurrency wallet information, Telegram files, Keychain data, device details, and developer-related files such as SSH, AWS, Kubernetes, Git, and shell configuration data.
Kaspersky also identified a new Objective-C backdoor component that impersonates Finder. It can establish persistence using a LaunchAgent, changes to the user’s .zshrc file, and global Git hooks. The component may also stop macOS notification processes, potentially reducing the chance that victims see security-related alerts.
- Run AppleScript received from a command-and-control server.
- Collect and upload additional files and system information.
- Deploy browser extensions or replace Ledger wallet software with attacker-supplied versions.
- Check and restore persistence after a reboot.
Users can reduce exposure by avoiding commands copied from unverified websites, treating unexpected administrator-password prompts cautiously, and downloading macOS software only from trusted sources.