Kaspersky researcher Sergey Puzan published a technical analysis on September 24 of a new variant of MacSync, a macOS information-stealing and crypto-theft malware family first seen in 2025 under the name Mac.c, that now delivers its payloads through a public iCloud calendar. In the sample Kaspersky examined, a downloader fetches a public iCloud CalDAV calendar event and pipes its description text into a zsh shell interpreter; most of the calendar text produces harmless errors, but commands placed after the event’s description marker execute, pulling down the rest of the malware. Apple’s own calendar-sharing infrastructure becomes the delivery channel, a legitimate service an organization has no reason to block outright.
The latest version also drops the script-based droppers earlier variants used in favor of compiled binaries: a Swift-based infostealer module and a separate Objective-C backdoor that disguises itself as macOS Finder, gains persistence through a LaunchAgent, .zshrc modifications and Git hooks, and can execute attacker-supplied AppleScript on demand. The infostealer targets browser history, cookies and saved credentials, cryptocurrency wallet extensions, Telegram data, the macOS Keychain file, and SSH, AWS, Kubernetes and Git configuration files, giving an attacker both personal credential theft and a foothold into a victim’s development and cloud tooling in one pass. Kaspersky traced distribution to a fake cryptocurrency wallet application called Toria, complete with its own website and promotion on X and Telegram.
The original insight is the shift in delivery infrastructure rather than the theft capability itself, which is largely unchanged from earlier MacSync samples: using a trusted cloud service most endpoint tools will not inspect closely mirrors the fake-job social engineering this desk covered in North Korea’s fake recruiter campaigns and the Waterplum malware kit advisory, where legitimate-looking channels, not novel exploits, do the work of getting past defenses. Security teams should treat unusual outbound connections to icloud.com from developer or crypto-adjacent endpoints as worth investigating, not dismiss them as noise.
Source: Kaspersky Securelist
