MacSync malware hides payloads in public iCloud calendars

A newly spotted variant of the MacSync infostealer is using public iCloud calendar events to deliver its next-stage payloads to macOS systems, according to Kaspersky researchers.

MacSync is written in Swift and first appeared in April 2025. It has recently been pushed through ClickFix campaigns, in which victims are tricked into running commands themselves. Those lures posed as Homebrew and as macOS tools for analysing disk space. Kaspersky says earlier versions of MacSync were derived from the AMOS stealer family. Since then, the malware has grown through additional modules.

A fake crypto wallet as bait

The operators rely on social engineering. Besides ClickFix-style attacks, they offer MacSync disguised as free or cracked software, or as brand-new applications.

In the campaign Kaspersky analysed, the malware was presented as a crypto wallet called Toria. The fake product had its own website and was promoted on social media platforms.

The researchers found two delivery methods within this campaign. The more elaborate one is what sets this variant apart.

Commands tucked into a calendar entry

In the longer chain, a downloader retrieves a public iCloud calendar event and passes the calendar data straight to zsh, the default macOS shell. Most of the calendar text is not valid shell syntax and produces errors. The commands placed after the event's DESCRIPTION: line do run, however.

Those commands pull an archive from iCloud that holds the malware components. Inside is an APP bundle that acts as a dropper. It starts further stages, which eventually fetch MacSync itself.

Because both the calendar and the archive sit on Apple's infrastructure, the traffic in these intermediate steps goes to a legitimate service rather than an obvious attacker server.

Same stealer, new backdoor

The infostealer module has seen few changes. It still goes after:

• browser history, cookies and saved credentials
• crypto wallet extension and app data
• Telegram data and the Keychain file
• system and device information
• SSH, AWS, Kubernetes, Git and shell configuration files

The new addition is a backdoor written in Objective-C that poses as Finder, the default file manager on macOS. Its installer sets up persistence in three ways: a LaunchAgent, changes to the .zshrc file and global Git hooks. It also kills macOS notification processes so the user does not see alerts about the changes.

Once in place, the backdoor can:

• run AppleScript sent from its command-and-control (C2) server
• deploy a browser extension, or swap an installed Ledger wallet app for a version supplied by the C2 server
• gather more system information and files and upload them to the server
• check its persistence and restore it so it survives a reboot

Kaspersky did not have the AppleScript code the backdoor would execute. The researchers worked out what each command does from its name and the status messages it returns.

One command remains unexplained. Called live_browser, it downloads and runs a component named sn_relay. Kaspersky could not determine what sn_relay does.

Advice for Mac users

Kaspersky recommends that macOS users avoid running commands they find online, avoid downloading DMG files from suspicious sites, and be careful with prompts asking for an administrator password.

Our Take

The calendar trick is a small detail with a clear purpose. Hiding commands in a public iCloud event lets the attackers use Apple's own services as a staging point. Network filters and users are less likely to flag that traffic than a connection to an unknown domain. This suggests the operators are putting real effort into evasion, not only into data theft.

The target list points in the same direction as many recent campaigns: crypto holders and people who work with cloud and developer tools. The Ledger replacement feature is a reminder that wallet users face more than just the kind of large exchange thefts seen in the Bitget hack. Stolen SSH, AWS, Kubernetes and Git files can also give attackers a foothold that reaches well beyond a single Mac.

It is worth watching whether other macOS malware families start abusing public calendar feeds in a similar way. Researchers may also eventually identify what sn_relay is built to do.