Researchers at Kaspersky have uncovered an updated iteration of MacSync, a Swift-based information-stealing threat targeting macOS systems that now employs public iCloud calendar events as a distribution mechanism for delivering fresh payloads. The malware first surfaced in April 2025 and has recently appeared in ClickFix-style campaigns masquerading as Homebrew and macOS storage analysis utilities.
According to Kaspersky's analysis, MacSync originated from the AMOS stealer family but has since expanded its functionality through the addition of modular capabilities.
Delivery chain
The malware has reached victims via social engineering tactics, including ClickFix-style attacks, as well as through applications presented as free, cracked, or newly released software. Researchers documented one instance where the threat actor distributed MacSync under the guise of Toria, a counterfeit cryptocurrency wallet complete with its own website and social media promotion.
Kaspersky identified two distinct delivery approaches employed in MacSync campaigns. The more sophisticated method involves a downloader that extracts commands embedded within the description field of a public iCloud calendar event, subsequently retrieving the next-stage payload from iCloud.
The downloader passes the retrieved calendar information to macOS's zsh shell. While most calendar text generates errors, commands positioned after the event's DESCRIPTION: line execute successfully and retrieve an archive containing malware components.
This archive houses an 'APP' bundle functioning as a dropper, which initiates additional stages that ultimately lead to MacSync malware deployment.
New backdoor module
The infostealer component has remained largely consistent, continuing to target browser history, cookies, stored credentials, cryptocurrency wallet extension and application data, Telegram information, the Keychain file, system and device details, SSH, AWS, Kubernetes, Git, and shell configuration files.
A newly identified module consists of an Objective-C backdoor that masquerades as Finder, macOS's built-in file manager. The installer establishes persistence through LaunchAgent configuration, .zshrc modifications, and global Git hooks, while simultaneously disabling macOS notification processes to prevent user alerts.
The backdoor supports the following capabilities on compromised systems:
- Execute attacker-controlled AppleScript obtained from the command-and-control server
- Install a browser extension or substitute an existing Ledger wallet application with versions provided by the C2 server
- Gather supplementary system information and files, then transmit them to the C2 server
- Verify and maintain persistence mechanisms to ensure reactivation following system reboot
Kaspersky determined the intended functions of these commands based on their naming conventions and status messages, as the researchers did not obtain access to the AppleScript code itself.
The analysis also revealed an unidentified command designated live_browser, which downloads and runs a component named sn_relay. Kaspersky was unable to ascertain the purpose of this particular component.
As MacSync continues advancing with increasingly sophisticated evasion and distribution strategies, macOS users should refrain from executing commands discovered online and exercise caution when downloading DMG files from untrusted sources. Additionally, administrators should remain vigilant regarding unexpected password prompts requesting elevated privileges.