A downloader fetches commands hidden in the description of a public iCloud calendar event and uses them to pull the next-stage payload from iCloud, according to Kaspersky researchers tracking a new variant of the MacSync macOS infostealer.
Kaspersky outlines the MacSync delivery chain
Kaspersky researchers report that MacSync, a Swift-based malware family that emerged in April 2025, has shifted its distribution techniques and added modular functionality. Earlier MacSync samples were derived from the AMOS stealer family, but Kaspersky says the campaign has evolved: recent deliveries have been tied to ClickFix-style social engineering and to software presented as free, cracked, or new applications — including fake utilities advertised as Homebrew packages or as a macOS disk space analyzer.
The threat actor also promoted a fake crypto wallet called Toria via a dedicated website and social media, Kaspersky found. In one of the campaign variants the researchers examined, a downloader interprets data hidden inside the description field of a public iCloud calendar event and passes that data to macOS’s zsh shell. Commands placed after the event’s DESCRIPTION: line execute, retrieve an archive from iCloud, and ultimately lead to an APP bundle that acts as a dropper for further stages that fetch MacSync.
How public iCloud calendars are being abused as a command channel
Kaspersky describes the iCloud-calendar technique as a two-step chain: the initial downloader queries a public calendar entry, extracts text, and feeds it to zsh. Most calendar text produces shell errors, but the specific commands appended after DESCRIPTION: run and fetch a remote archive hosted on iCloud. That archive contains the next-stage components used to install and run the malware.
Because the retrieval path leverages Apple’s iCloud hosting and a standard calendar feature, the researchers flag the method as an unusual but effective channel for hiding commands and lowering the cost of hosting payloads for the operator.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildThe new Objective-C backdoor disguised as Finder
Alongside the existing infostealer module, Kaspersky identified a newly observed Objective-C backdoor that impersonates Finder, macOS’s default file manager. The backdoor’s installer establishes persistence through multiple mechanisms: a LaunchAgent entry, .zshrc modifications, and global Git hooks. It also terminates macOS notification processes to prevent alerts from reaching the user.
Kaspersky lists capabilities the backdoor can perform when commanded by its C2 server: run attacker-supplied AppleScript, deploy a browser extension or replace an installed Ledger wallet app with versions served by the C2, collect and upload additional system information and files, and re-check or re-establish persistence so the backdoor survives reboots. The researchers inferred the purposes of commands from their names and status messages because they did not possess the AppleScript code the commands would execute.
Kaspersky also observed a “mystery” command named live_browser that downloads and runs a component called sn_relay; the company said it could not determine sn_relay’s purpose from the samples it analyzed.
The infostealer’s targets and data-stealing reach
Kaspersky reports that the core infostealer module remains largely unchanged and continues to harvest a broad set of sensitive artifacts: browser history, cookies and saved credentials; crypto wallet extension and app data; Telegram data; the Keychain file; system and device information; SSH keys and configuration; AWS, Kubernetes and Git credentials; and shell configuration files. The combined toolset is designed to collect credentials and artifacts that can feed account takeover, lateral movement, and post-exploitation activity.
What this means for macOS users, security teams, and threat actors
- macOS users: Kaspersky explicitly recommends avoiding executing commands copied from online pages, not downloading DMG files from suspicious sites, and treating admin password prompts with caution. The campaign’s use of fake utility installers and an impersonated wallet (Toria) reinforces those concrete steps.
- Security teams and incident responders: Defenders should look for indicators consistent with the campaign’s persistence mechanisms — LaunchAgent entries, .zshrc modifications, and unexpected global Git hooks — and also consider unusual use of iCloud-hosted resources or public calendar entries as part of threat-hunting and telemetry analysis.
- Threat actors and fraudsters: The campaign demonstrates a preference for social engineering (ClickFix-style lures, fake cracked software) and for leveraging legitimate cloud services — in this case, public iCloud calendars — as low-cost command-and-control and distribution channels, a technique attackers may continue to refine.
MacSync’s move from an AMOS-derived infostealer to a modular suite that includes an Objective-C Finder impersonator and an iCloud-based command channel illustrates how adversaries blend social engineering, cloud hosting, and platform-native features to avoid detection. Kaspersky’s inability to decode the live_browser/sn_relay component leaves one practical question open: what further functionality might operators activate next through this evolving chain? For now, the concrete takeaway remains the same in Kaspersky’s advisory — be wary of commands you find online, dubious DMG files, and unexpected administrative prompts.
