MacSync macOS Malware Abuses Public iCloud Calendars

Kaspersky has published analysis of a new MacSync variant that routes command-and-control instructions through public iCloud Calendar events. The C2 traffic runs over Apple’s own cloud infrastructure, which makes it harder to block without disrupting native Calendar sync.

MacSync has two components: an infostealer written in Swift and a backdoor written in Objective-C. The new variant adds a downloader that reads text from the DESCRIPTION: field of a public iCloud calendar event, pipes that text to zsh, and uses the resulting shell commands to pull a payload archive from iCloud. No authentication is required to read a public calendar.

What gets exfiltrated

The infostealer module targets browser credentials and cookies, macOS Keychain data, crypto wallet applications and extensions, Telegram session files, and configuration files for SSH, AWS, Kubernetes, and Git. The backdoor executes arbitrary AppleScript fetched from the attacker-controlled calendar, can deploy or swap browser extensions, and verifies that persistence survives reboot. In one documented case it replaced the Ledger hardware wallet desktop application.

MacSync maintains persistence through a LaunchAgent, .zshrc modifications, and global Git hooks. It terminates macOS notification daemons to suppress alerts.

How it arrives

Kaspersky observed two delivery paths. The first is ClickFix campaigns distributing a fake Homebrew installer or a fake macOS disk-analyzer tool. The user sees an instruction to run a terminal command; that command drops the MacSync downloader. The second path is a fake cryptocurrency wallet application called “Toria,” promoted through social media and a purpose-built website.

ClickFix is not new to macOS malware. AmnesiaStealer used the same technique to hijack macOS browser sessions earlier this year, and the September Apple patch cycle addressed over 200 vulnerabilities across macOS Golden Gate and iOS 27 that post-compromise payloads can still reach on unpatched systems.

What to do

Three actions cover the main exposure:

• Do not run terminal commands copied from websites, support chats, or any source you haven’t independently verified. ClickFix lives entirely on that one user action.
• Treat unexpected macOS admin password prompts as suspicious, particularly during installs from outside the Mac App Store.
• If you use a hardware crypto wallet, verify software signatures and download sources before installing or updating any associated desktop application.

Kaspersky’s full technical analysis and IOC set are at Securelist. The variant is detected by Kaspersky endpoint products; ensure your security tooling is current.