CTI · reviewed · 2026-09-25

MacSync malware uses public iCloud calendars to deliver new payloads

Full story & timeline

MITRE ATT&CK

• T1204 User Execution Execution
• T1059 Command and Scripting Interpreter Execution
• T1102 Web Service Command and Control
• T1159 Launch Agent Persistence
• T1037 Boot or Logon Initialization Scripts Persistence

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• caldav.icloud domain · active
• com.apple.finder.agent domain · active
• gateway.icloud domain · active
• zk-call-messenger-installer-3.9.2-lts.dmg domain · revoked
• zkcall.net domain · revoked

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://securelist.com/macsync-new-version/121383/
• https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/