Reported by 4 outlets
MacSync malware uses public iCloud calendars to deliver new payloads
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.10 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Kaspersky researcher Sergey Puzan reported on September 24 that a new MacSync variant, first seen in the wild in September 2026, delivers payloads through public iCloud calendar events. A downloader fetches commands hidden after the DESCRIPTION: line of an event on caldav.icloud.com, feeds the calendar text to zsh where most lines fail harmlessly and the planted commands run, then pulls Loader.app.tar.gz from gateway.icloud.com. Abusing legitimate Apple infrastructure means the command channel blends into ordinary iCloud traffic and is hard to block without collateral damage.
The final payloads moved from the family's earlier AppleScript base to binary droppers written in Swift and Objective-C, supporting both Apple silicon and Intel Macs. The chain installs an Objective-C backdoor disguised as Finder, build BLD-150, with persistence through a com.apple.finder.agent LaunchAgent, .zshrc modification, and global Git hooks, plus VM detection and anti-debugging checks. Distribution runs through ClickFix-style lures, including a fake cryptocurrency wallet named Toria with its own site at toria.app promoted on X and Telegram, and earlier campaigns abused Google Ads and Claude artifacts to surface fake download pages.
MacSync debuted in April 2025 as Mac.C, attributed to the actor Mentalpositive and derived from the AMOS stealer family, and is sold as malware-as-a-service. Jamf previously documented a variant delivered as a code-signed and notarized Swift app in zk-call-messenger-installer-3.9.2-lts.dmg from zkcall.net under Developer Team ID GNJLS3UYZ4, with the certificate only revoked after reporting to Apple. Kaspersky published roughly twenty sample hashes and the two iCloud dead-drop URLs as IOCs. Watch for further abuse of calendar and iCloud dead drops by other Mac malware families, and do not treat notarization as a trust signal.
Timeline
-
original reporting
MacSync malware uses public iCloud calendars to deliver new payloads
bleepingcomputer.com · 19d ago · September 24th, 2026
A new variant of the MacSync info-stealing malware targeting macOS systems now uses public iCloud calendar events to deliver fresh payloads. MacSync is a Swift-based malware that emerged in April 2025 and has been observed recently being delivered in ClickFix campaigns disguised as Homebrew and macOS disk space analyzer tools. Kaspersky researchers say that while earlier versions of the malware were derived from the AMOS stealer family, MacSync evolved and added new capabilities via modules. Delivery chain MacSync has been distributed to victims through social engineering, including ClickFix-style attacks, and through software presented as free, cracked, or as new applications. The researchers note that the threat actor delivered the malware as a fake crypto wallet called Toria, which had a dedicated website and was promoted over social media platforms. Kaspersky discovered the MacSync campaign that had two delivery methods. In the more complex one, a downloader fetches commands hidden in the description of a public iCloud calendar event, and then downloads the next-stage payload from iCloud. The downloader feeds the retrieved calendar data to macOS's zsh shell. Most of the calendar text produces errors, but commands placed after the event’s DESCRIPTION: line run and fetch an archive with the malware components. The archive contains an ‘APP’ bundle that acts as a dropper, leading to more stages that eventually retrieve the MacSync malware. The latest MacSync infection chains
-
update from bleepingcomputer.com
New MacSync malware dropper evades macOS Gatekeeper checks
bleepingcomputer.com · 295d ago · December 22nd, 2025
Jamf researchers documented a MacSync variant delivered as a code-signed and notarized Swift application inside a disk image named zk-call-messenger-installer-3.9.2-lts.dmg, distributed from zkcall.net under Developer Team ID GNJLS3UYZ4. The certificate was revoked after a report to Apple. The same report traces the family to its April 2025 debut as Mac.C by the actor Mentalpositive and notes anti-sandbox connectivity checks and decoy PDF padding inflating the DMG to 25.5 MB.
-
update from bleepingcomputer.com
Claude LLM artifacts abused to push Mac infostealers in ClickFix attack
bleepingcomputer.com · 242d ago · February 13th, 2026
Threat actors abused Claude artifacts and Google Ads in ClickFix campaigns delivering macOS infostealers, MacSync included, to users searching for software downloads. This is the earlier ClickFix delivery reporting that the September 2026 iCloud calendar chain builds on.
-
update from securelist.com
MacSync under the microscope: new delivery methods and a new payload
securelist.com · 20d ago · September 24th, 2026
Kaspersky's Securelist report by Sergey Puzan, dated 24 Sep 2026 on the page, is the original researcher disclosure behind the next-day trade coverage: the chain was first spotted in the wild in September 2026 and stages commands through a public calendar at caldav.icloud[.]com, with Loader.app.tar.gz fetched from gateway.icloud[.]com. It catalogs the Objective-C Finder-disguised backdoor, build BLD-150, persistence via the com.apple.finder.agent LaunchAgent plus .zshrc and global Git hooks, and roughly twenty sample hashes, the Toria wallet lure (toria[.]app), and two iCloud dead-drop URLs as IOCs. Timestamp carries date-only precision from the page.
-
update from www.bleepingcomputer.com
MacSync malware uses public iCloud calendars to deliver new payloads https:// bleepingcomputer.com/news/security/ macsync-malware-uses-publi
www.bleepingcomputer.com · 19d ago · September 24th, 2026
MacSync malware uses public iCloud calendars to deliver new payloads https:// bleepingcomputer.com/news/security/ macsync-malware-uses-publi
via X https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/
-
update from cyberpress.org
MacSync’s New Infection Chain Shows How Mac Malware Is Becoming More Sophisticated
cyberpress.org · 18d ago · September 25th, 2026
A new version of MacSync is using a longer, more complex infection chain to install an information stealer and a backdoor on macOS devices . Unlike earlier versions built largely around AppleScript, it uses binary droppers and final payloads written in Swift and Objective-C. MacSync is sold as malware-as-a-service, so operators can choose how to lure victims. The latest samples arrive in malicious DMG disk images disguised as software. In one campaign, the attackers promoted “Toria,” a nonexistent cryptocurrency wallet, through a website and posts on X and Telegram. The binaries support both Apple silicon and Intel Macs. MacSync Malware Evolves Its Tactics In the more complex infection chain, the app inside the DMG removes its quarantine attribute and decrypts a hidden URL to find the next stage. Other samples used an attacker-controlled server instead of the calendar. MacSync Malware Evolves Its Tactics (Source: securelist) The downloaded app unpacked an encrypted executable, which led to another dropper. That stage checked for a virtual machine and used an anti-debugging setting to make analysis harder. A custom tool called p
-
update from securelist.com
New MacSync Malware Turns macOS Apps Into Tools for Crypto and Password Theft Indicators extracted from public reporting. Source: https:// s
securelist.com · 18d ago · September 25th, 2026
New MacSync Malware Turns macOS Apps Into Tools for Crypto and Password Theft Indicators extracted from public reporting.
-
mentioned by www.bleepingcomputer.com
# MacSync # malware uses public # iCloud calendars to deliver new payloads https://www. bleepingcomputer.com/news/secu rity/macsync-malware-
www.bleepingcomputer.com · 18d ago · September 25th, 2026