Hackers Weaponize Public iCloud Calendars To Deploy MacSync Malware

by Aaron Leong — Friday, September 25, 2026, 11:06 AM EDT

There's a new, more creative MacSync attack that leverages iCloud for package delivery - Image: Apple

Cybersecurity researchers at Kaspersky have uncovered a sneaky new variant of the MacSync malware, revealing a unique tactic where attackers exploit public Apple iCloud calendar events to secretly dump malicious payloads onto macOS devices.

Originally appearing as a simple script-based information stealer derived from the AMOS family, MacSync has evolved into a complex, modular threat delivered through a Malware-as-a-Service model. Distributed via things like fake crypto wallets (like Toria), cracked developer software, and deceptive ClickFix prompts, this infection chain replaces old AppleScript droppers with compiled Swift and Objective-C binary loaders designed to bypass traditional detection mechanisms.

The new MacSync infection process - Image: Kaspersky

What sets this technique apart is integration of the public iCloud infrastructure. Kaspersky found that in one delivery path, the initial downloader retrieves calendar data formatted as an `.ics` file hosted on public iCloud servers. The downloader feeds this calendar file directly to the system's `zsh` shell. While the vast majority of the calendar text triggers harmless syntax errors, embedded shell commands tucked right after the event’s `DESCRIPTION:` line quietly execute in the background. These commands instruct the system to download a compressed archive directly from iCloud, unpacking a chain of droppers that ultimately deploys the main MacSync payloads.

Once inside, MacSync deploys two distinct modules: an information stealer and a persistent backdoor. The infostealer prompts users with fake password dialogues to grab administrator credentials, subsequently sweeping web browsers for history, cookies, and saved passwords. It targets browser-based cryptocurrency wallet extensions, desktop wallet apps, Telegram sessions, login credentials, and System Keychain files, alongside sensitive developer configurations for SSH, AWS, Kubernetes, Git, and command-line shell history.

Password prompts generated by malware - Image: Kaspersky

Simultaneously, the Objective-C backdoor establishes deep persistence on the infected system by disguising itself as the legitimate macOS Finder app. The backdoor creates persistent LaunchAgents, alters shell configuration files (`.zshrc`), and injects global Git pre-commit and post-checkout hooks, plus to keep the victim entirely in the dark, it actively kills macOS notification alerts from popping up when security settings are altered.

Through its command-and-control connection, the backdoor can execute arbitrary AppleScript commands sent by the attacker. This grants operators the ability to silently inject malicious browser extensions or even replace installed wallet applications with trojanized versions to hijack crypto transactions.

Kaspersky warns macOS users to remain vigilant against unexpected admin password prompts, avoid running terminal commands copy-pasted from untrusted websites, and restrict software downloads exclusively to verified, official sources.