Kaspersky researchers discovered a new version of the MacSync information-stealing malware targeting macOS devices. It uses events in public iCloud calendars to hide download commands and obtain additional malicious payloads. This method gives attackers a distribution channel that appears, on the surface, to be an ordinary cloud service rather than relying on an exposed download server.
MacSync emerged in April 2025 and is malware written in Swift. Its first versions were derived from the AMOS information-stealing family before evolving through the addition of new modules. Its distribution was observed in ClickFix campaigns, as well as through fake tools such as Homebrew programs and disk-space analysis tools, or free and pirated applications.
How Does the Distribution Chain Work?
In one case, the malware was distributed as a fake cryptocurrency wallet called Toria, with a dedicated website promoting it through social media platforms. The more complex distribution chain observed by Kaspersky begins with a downloader that extracts commands from the description of an event in a public iCloud calendar.
The downloader passes the calendar data to a zsh shell in macOS. Most of the event’s contents produce errors, but commands placed after the DESCRIPTION: line are executed to retrieve an archive from iCloud. The archive contains an APP-format application bundle that functions as a dropper, then leads to further stages ending with the download of MacSync components.
Theft Capabilities and Backdoor
The information-stealing module continues to target browser history, cookies, and saved login credentials, in addition to cryptocurrency wallet data and applications, Telegram data, the Keychain file, system and device information, SSH, AWS, Kubernetes, and Git files, and shell configuration.
The most notable addition is an Objective-C backdoor that impersonates Finder, the default file manager in macOS. It establishes persistence through a LaunchAgent and modifications to the .zshrc file and global Git hooks. It also terminates macOS notification processes to reduce the likelihood of alerts appearing to the user.
- Execute AppleScript sent by the command-and-control server.
- Install a browser extension or replace the installed Ledger application with a version sent by the server.
- Collect additional information and files and upload them to the control server.
- Check for and create persistence mechanisms to ensure operation after a reboot.
Kaspersky researchers inferred the functions of some commands from their names and status messages because they did not obtain the AppleScript code that would execute them. They also observed an obscure command named live_browser that downloads and runs a component called sn_relay, without being able to determine its function.
Why Does This Matter?
The practical change is not limited to the addition of a new theft capability; exploiting a public iCloud calendar expands distribution options and makes the malicious infrastructure less apparent to the user. Impersonating Finder and creating multiple persistence mechanisms also increases the impact of an infection, particularly on devices containing cloud access keys, session tokens, or wallet data.
Kaspersky recommends that macOS users avoid executing commands they find online, avoid DMG files from suspicious websites, and exercise caution with administrator password requests. The function of the sn_relay component and some AppleScript commands remain open questions in the available analysis.