[
 {
  "value": "caldav.icloud",
  "type": "domain",
  "first_seen": "2026-09-24",
  "last_seen": "2026-09-24",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl"
  ],
  "sources": [
   "https://securelist.com/macsync-new-version/121383/"
  ],
  "reason": "iCloud CalDAV dead-drop (caldav.icloud[.]com) staging commands for MacSync macOS stealer (Kaspersky IOC)"
 },
 {
  "value": "com.apple.finder.agent",
  "type": "domain",
  "first_seen": "2026-09-24",
  "last_seen": "2026-09-24",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl"
  ],
  "sources": [
   "https://securelist.com/macsync-new-version/121383/"
  ],
  "reason": "LaunchAgent persistence name of PamStealer macOS infostealer"
 },
 {
  "value": "gateway.icloud",
  "type": "domain",
  "first_seen": "2026-09-24",
  "last_seen": "2026-09-24",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl"
  ],
  "sources": [
   "https://securelist.com/macsync-new-version/121383/"
  ],
  "reason": "iCloud dead-drop (gateway.icloud[.]com) delivering MacSync Loader.app.tar.gz payload (Kaspersky IOC)"
 },
 {
  "value": "zk-call-messenger-installer-3.9.2-lts.dmg",
  "type": "domain",
  "first_seen": "2025-12-22",
  "last_seen": "2025-12-22",
  "status": "revoked",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl"
  ],
  "sources": [
   "https://www.bleepingcomputer.com/news/security/new-macsync-malware-dropper-evades-macos-gatekeeper-checks/"
  ],
  "reason": "Code-signed malicious installer disk image of MacSync variant"
 },
 {
  "value": "zkcall.net",
  "type": "domain",
  "first_seen": "2025-12-22",
  "last_seen": "2025-12-22",
  "status": "revoked",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl"
  ],
  "sources": [
   "https://www.bleepingcomputer.com/news/security/new-macsync-malware-dropper-evades-macos-gatekeeper-checks/"
  ],
  "reason": "MacSync malware distribution domain"
 }
]