MacSync malware hides commands in public iCloud calendars
MacSync, a Swift‑based macOS malware, now uses public iCloud calendar events to fetch payloads, adding a stealthy delivery channel to its existing ClickFix‑style lures.
Businesses that rely on macOS laptops should note a new information‑stealing threat that is using a surprisingly public channel, iCloud calendar events, to pull in additional malicious components. The technique was first observed in recent campaigns and shows how attackers are exploiting everyday Apple services to bypass traditional security controls.
How the infection reaches a Mac
- Social‑engineering delivery, The initial payload is packaged as a fake Homebrew installer, a disk‑space analyser, or a counterfeit crypto‑wallet called Toria. These ClickFix‑style lures convince users to run what looks like a legitimate utility.
- iCloud calendar command channel, Once the first stage runs, it contacts a public iCloud calendar and reads the description field. The text is fed to the macOS zsh shell, which executes the hidden commands. The shell then downloads an archive from iCloud.
- Dropper bundle, The downloaded file is an APP bundle that acts as a dropper. It extracts further stages that eventually load the core MacSync malware.
Photo by Leeloo The First on Pexels
New backdoor capabilities
| Observation | What it does |
|---|---|
| Objective‑C backdoor disguised as Finder | Appears as the Finder app, installs a LaunchAgent, amends the user's .zshrc file and adds global Git hooks to stay resident. |
| AppleScript execution | Runs attacker‑supplied AppleScript, allowing arbitrary commands on the host. |
| Browser or Ledger‑wallet replacement | Deploys a malicious browser extension or swaps out a Ledger wallet application. |
| Data collection | Harvests system information, SSH keys, AWS and Kubernetes credentials, Git configuration files and other shell config files. |
| Exfiltration | Sends the collected data to a command‑and‑control (C2) server. |
| Notification suppression | Terminates macOS notification processes so the user does not see alerts. |
| "live_browser" command | Downloads and runs a component named sn_relay; its purpose remains unknown. |
All of the above points are confirmed by the analysis shared by our partner Kaspersky.
What you should check
- Review recent installations, Look for any unexpected Homebrew, disk‑space analyser or crypto‑wallet apps that were installed in the past few weeks.
- Inspect iCloud calendar subscriptions, Verify that no public calendars are subscribed to on corporate devices. Remove any that are unnecessary.
- Audit persistence mechanisms, Search for unknown LaunchAgents in ~/Library/LaunchAgents, unexpected entries in .zshrc, and global Git hooks under $(git config --system --list).
- Monitor network traffic to iCloud domains, Unusual download patterns from iCloud storage may indicate the dropper stage.
- Run endpoint detection, Ensure macOS‑compatible anti‑malware tools are up to date and scan for the MacSync binaries and the sn_relay component.
Terms used in this article
- Swift, A programming language created by Apple for developing iOS, macOS and other platform apps.
- ClickFix, A style of social‑engineering attack where a malicious file is disguised as a useful utility.
- LaunchAgent, A macOS mechanism that runs a program automatically at login or at scheduled intervals.
- C2 server, A command‑and‑control server that receives data from compromised machines and sends further instructions.
- AppleScript, A scripting language for automating tasks on macOS.
Staying vigilant about unusual calendar subscriptions and regularly auditing persistence hooks can help stop this chain before it reaches the data‑stealing stage.
