MacSync hides its next-stage commands in public iCloud calendar events
Kaspersky says a new MacSync variant hides its payload commands in public iCloud calendar events and downloads the next stage from iCloud. Both the instructions and the download ride trusted Apple domains, past defenses that block known-bad hosts.
The Watch · Security desk
What happened
- Kaspersky ties MacSync's earlier versions to the AMOS stealer family and says the malware later moved its capabilities into modules.
- A new Objective-C backdoor disguises itself as Finder, persists through a LaunchAgent, .zshrc edits and global Git hooks, and kills macOS notification processes so the user sees no alerts.
- Kaspersky flagged a 'mystery' command called live_browser that runs a component named sn_relay whose purpose the researchers could not determine.
Why it matters
- What it limits constraint With both the command channel and the payload hosted on iCloud, a blocklist of known-bad domains has nothing to match; the traffic goes to Apple.
- Who's exposed exposure The backdoor can swap an installed Ledger wallet app for a C2-supplied version, putting a victim's crypto at direct risk.
- Who has to decide decision Detection shifts from host reputation to behavior: a trusted Apple service feeding text into zsh becomes the thing to watch.
Next story · Security · Oct 6
Fake Cloudflare checks on more than 100 hacked sites trick Ukrainians into installing Lunex StealerConfirmed3 publishers
The trick is where the two halves of the delivery live. In the more complex of two chains Kaspersky found, a downloader reads its instructions from the description field of a public iCloud calendar event, then pulls the next-stage archive from iCloud as well [5]. Both hops go to Apple. A blocklist built from known-bad domains has nothing to match.
The calendar text is fed straight into zsh. Most of it produces errors. The working commands sit after the event's DESCRIPTION: line and fetch an archive of malware components [6]. That archive carries an APP bundle that acts as a dropper for later stages, and those stages end in MacSync [7].
MacSync is not new. It is Swift-based, surfaced in April 2025, and Kaspersky traces its earlier builds to the AMOS stealer family before the author moved capabilities into modules [14][3]. Recent rounds arrived through ClickFix lures posing as Homebrew and a macOS disk-space analyzer, and through a fake crypto wallet called Toria that had its own site and social-media promotion [2][4].
The stealer module is unchanged. It still takes browser history, cookies and saved credentials, crypto wallet data, Telegram data, the Keychain file, and SSH, AWS, Kubernetes, Git and shell configuration files [8]. The new piece is an Objective-C backdoor that poses as Finder. It persists through a LaunchAgent, .zshrc edits and global Git hooks, and it kills macOS notification processes so the user sees no alerts [9]. From its C2 it can run attacker-supplied AppleScript, install a browser extension, replace an installed Ledger wallet app with a version the C2 supplies, and upload files [10].
Kaspersky did not have the AppleScript itself, so it read the commands' purpose from their names and status messages [11]. One command, live_browser, downloads and runs a component called sn_relay that the researchers could not identify [12].
The advice is narrow: do not paste commands you find online into a terminal, avoid DMG files from unfamiliar sites, and treat admin password prompts with caution [13]. The harder problem is upstream. When the C2 channel and the payload both ride iCloud, there is no bad domain to flag; what defenders can still see is a trusted Apple service feeding text into a shell [5][6].
What to watch
- Whether Apple restricts programmatic reads of public calendar event descriptions or the iCloud paths used for staging.
- Whether Kaspersky or others recover the AppleScript and identify what the sn_relay component does.
- Whether the same trusted-service delivery pattern turns up in other macOS stealers beyond MacSync.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence68
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A new variant of the MacSync info-stealing malware targeting macOS now uses public iCloud calendar events to deliver fresh payloads.
- [2]
MacSync has recently been observed being delivered in ClickFix campaigns disguised as Homebrew and macOS disk space analyzer tools.
- [3]
Kaspersky researchers say earlier versions of MacSync were derived from the AMOS stealer family, and that the malware evolved and added new capabilities via modules.
- [4]
The threat actor delivered the malware as a fake crypto wallet called Toria, which had a dedicated website and was promoted over social media platforms.
- [5]
Kaspersky discovered a MacSync campaign with two delivery methods; in the more complex one, a downloader fetches commands hidden in the description of a public iCloud calendar event and then downloads the next-stage payload from iCloud.
- [6]
The downloader feeds the retrieved calendar data to macOS's zsh shell; most of the calendar text produces errors, but commands placed after the event's DESCRIPTION: line run and fetch an archive with the malware components.
- [7]
The archive contains an APP bundle that acts as a dropper, leading to more stages that eventually retrieve the MacSync malware.
- [8]
The infostealer module remains largely unchanged, targeting browser history, cookies and saved credentials, crypto wallet extension and app data, Telegram data, the Keychain file, system and device information, and SSH, AWS, Kubernetes, Git and shell configuration files.
- [9]
The new module is an Objective-C backdoor that disguises itself as Finder; its installer establishes persistence through a LaunchAgent, .zshrc modifications and global Git hooks, and it terminates macOS notification processes to prevent alerts from reaching the user.
- [10]
The backdoor can run attacker-supplied AppleScript from its C2 server, deploy a browser extension or replace an installed Ledger wallet app with C2-supplied versions, collect and upload additional system information and files, and establish persistence.
- [11]
Kaspersky inferred the commands' purposes from their names and status messages because it did not have the AppleScript code they would execute.
- [12]
Kaspersky identified a 'mystery' command, live_browser, which downloads and executes a component called sn_relay, whose purpose the researchers could not determine.
- [13]
Kaspersky advises macOS users to avoid executing commands they find online, avoid downloading DMG files from suspicious sites, and treat admin password prompts with caution.
- [14]
MacSync is a Swift-based malware that emerged in April 2025.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comMacSync malware uses public iCloud calendars to deliver new payloads
1 article · September 24, 2026
- helpnetsecurity.comMacSync info-stealing malware hides malicious commands in an iCloud calendar
1 article · September 25, 2026
Topics and entities
Topics
- Infostealers
- Attacks on developers
- macOS Malware
- ClickFix