Researchers at Kaspersky have identified an updated version of the MacSync info-stealing malware that uses public iCloud calendar events as a covert delivery channel for new payloads on macOS systems.

MacSync, a Swift-based stealer that first appeared in April 2025, was originally derived from the AMOS stealer family but has since evolved into a modular threat. It has recently been observed in ClickFix-style campaigns, disguised as Homebrew installers and macOS disk space analyzer utilities. The malware has also been distributed through fake, cracked, or newly branded software, including a bogus cryptocurrency wallet called Toria that was promoted via a dedicated website and social media.

Calendar-Based Delivery Chain

Kaspersky found two delivery methods used in the campaign. The more sophisticated one relies on a downloader that reads a public iCloud calendar event, extracts commands hidden in the event’s description field, and feeds that text to the macOS zsh shell. Most of the calendar content is inert and generates errors, but text placed after the event’s DESCRIPTION line executes as valid shell commands, retrieving an archive containing the malware components.

That archive includes an APP bundle acting as a dropper, which triggers additional stages before ultimately installing the MacSync payload.

Infostealer and New Backdoor Module

The core infostealer functionality remains largely consistent with earlier versions, targeting browser history, cookies, and saved credentials, cryptocurrency wallet extensions and app data, Telegram data, the macOS Keychain file, system and device information, and SSH, AWS, Kubernetes, Git, and shell configuration files.

The notable addition is an Objective-C backdoor module that disguises itself as Finder, the default macOS file manager. Its installer establishes persistence through a LaunchAgent, modifications to .zshrc, and global Git hooks, and it terminates notification processes to keep alerts from reaching the victim.

  • Execute attacker-supplied AppleScript from its command-and-control server
  • Deploy a malicious browser extension or replace an installed Ledger wallet app with a C2-supplied version
  • Collect additional system data and files and exfiltrate them to the C2 server
  • Verify and reestablish persistence after reboot

Because Kaspersky did not have access to the AppleScript payloads themselves, the researchers inferred command purposes from naming conventions and status messages. One command, live_browser, downloads and runs a component called sn_relay whose exact function could not be determined.

Recommendations

Kaspersky advises macOS users to avoid running shell commands copied from online sources, refrain from downloading DMG files from untrusted sites, and treat unexpected admin password prompts with suspicion.