> ## Content Index
> Fetch the complete content index at: https://blog.stratum.my/llms.txt
> Use this file to discover other available public pages before exploring further.

# MacSync malware hides commands in public iCloud calendars
- URL: https://blog.stratum.my/macsync-icloud-calendar-malware/
- Published: 2026-09-25T15:13:13.000Z
- Updated: 2026-09-25T15:13:13.000Z
- Description: MacSync, a Swift‑based macOS malware, now uses public iCloud calendar events to fetch payloads, adding a stealthy delivery channel to its existing ClickFix‑style lures.
- Author: JW
- Tags: macOS, malware, iCloud, security advisory

Businesses that rely on macOS laptops should note a new information‑stealing threat that is using a surprisingly public channel, iCloud calendar events, to pull in additional malicious components. The technique was first observed in recent campaigns and shows how attackers are exploiting everyday Apple services to bypass traditional security controls.

## How the infection reaches a Mac

- **Social‑engineering delivery**, The initial payload is packaged as a fake Homebrew installer, a disk‑space analyser, or a counterfeit crypto‑wallet called *Toria*. These ClickFix‑style lures convince users to run what looks like a legitimate utility.
- **iCloud calendar command channel**, Once the first stage runs, it contacts a public iCloud calendar and reads the description field. The text is fed to the macOS *zsh* shell, which executes the hidden commands. The shell then downloads an archive from iCloud.
- **Dropper bundle**, The downloaded file is an *APP* bundle that acts as a dropper. It extracts further stages that eventually load the core MacSync malware.

![Overhead shot of a desk with a laptop, smartphone, calendar, pen, and 'BLOCKCHAIN' text.](https://images.pexels.com/photos/7887811/pexels-photo-7887811.jpeg?auto=compress&cs=tinysrgb&h=650&w=940)

*Photo by* [*Leeloo The First*](https://www.pexels.com/@leeloothefirst?ref=blog.stratum.my) *on Pexels*

## New backdoor capabilities

| Observation                              | What it does                                                                                                                   |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| Objective‑C backdoor disguised as Finder | Appears as the Finder app, installs a LaunchAgent, amends the user's *.zshrc* file and adds global Git hooks to stay resident. |
| AppleScript execution                    | Runs attacker‑supplied AppleScript, allowing arbitrary commands on the host.                                                   |
| Browser or Ledger‑wallet replacement     | Deploys a malicious browser extension or swaps out a Ledger wallet application.                                                |
| Data collection                          | Harvests system information, SSH keys, AWS and Kubernetes credentials, Git configuration files and other shell config files.   |
| Exfiltration                             | Sends the collected data to a command‑and‑control (C2) server.                                                                 |
| Notification suppression                 | Terminates macOS notification processes so the user does not see alerts.                                                       |
| "live\_browser" command                  | Downloads and runs a component named *sn\_relay*; its purpose remains unknown.                                                 |

All of the above points are confirmed by the analysis shared by our partner Kaspersky.

## What you should check

1. **Review recent installations**, Look for any unexpected Homebrew, disk‑space analyser or crypto‑wallet apps that were installed in the past few weeks.
2. **Inspect iCloud calendar subscriptions**, Verify that no public calendars are subscribed to on corporate devices. Remove any that are unnecessary.
3. **Audit persistence mechanisms**, Search for unknown LaunchAgents in *\~/Library/LaunchAgents*, unexpected entries in *.zshrc*, and global Git hooks under *$(git config --system --list)*.
4. **Monitor network traffic to iCloud domains**, Unusual download patterns from iCloud storage may indicate the dropper stage.
5. **Run endpoint detection**, Ensure macOS‑compatible anti‑malware tools are up to date and scan for the MacSync binaries and the *sn\_relay* component.

## Terms used in this article

- **Swift**, A programming language created by Apple for developing iOS, macOS and other platform apps.
- **ClickFix**, A style of social‑engineering attack where a malicious file is disguised as a useful utility.
- **LaunchAgent**, A macOS mechanism that runs a program automatically at login or at scheduled intervals.
- **C2 server**, A command‑and‑control server that receives data from compromised machines and sends further instructions.
- **AppleScript**, A scripting language for automating tasks on macOS.

Staying vigilant about unusual calendar subscriptions and regularly auditing persistence hooks can help stop this chain before it reaches the data‑stealing stage.