MacSync Malware Hides Commands in Public iCloud Calendars

Most command and control servers live on cheap domains that a blocklist can kill in minutes. The newest MacSync malware chain sidesteps that by parking its instructions on Apple's servers. In a report published September 24, 2026, Kaspersky describes a loader that downloads a public iCloud calendar and pipes it straight into the macOS shell. To a firewall, it looks like a calendar subscription.

Key Takeaways

• Kaspersky published its analysis of a new MacSync infection chain on September 24, 2026.
• In at least one sample, the loader fed a public caldav.icloud.com calendar into zsh -s, which ran the commands hidden after the event's DESCRIPTION line.
• Those commands pulled the next stage from iCloud too, so two consecutive stages ran on Apple infrastructure.
• The final payload pairs a Swift stealer that grabs browser data, Keychain files, and cloud and SSH configs with an Objective-C backdoor disguised as Finder.
• MacSync is sold as malware as a service and primarily targets developers and crypto users, according to Kaspersky.

What Changed in the New MacSync Chain?

The new chain swaps earlier script droppers for compiled binaries and adds Apple hosted infrastructure as an intermediate stage. MacSync was first advertised in 2025 as Mac.c, and BleepingComputer dates its emergence to April 2025.

We covered the previous generation in March, when ClickFix pages pushing fake AI tools tricked Mac users into pasting one Terminal command. BleepingComputer also tracked ClickFix lures posing as Homebrew and disk space analyzers. The new entry point is a malicious DMG posing as cracked apps or as Toria, a nonexistent crypto wallet promoted with its own web page and X and Telegram accounts.

How Does the iCloud Calendar C2 Work?

The calendar is a dead drop: the attacker writes shell commands into a public event, and the malware runs the whole calendar file as a script. Per Kaspersky:

• The .APP inside the DMG strips the com.apple.quarantine attribute with xattr -cr.
• It reads its file overlay backwards, finds the magic word SONOMAC1, and XOR decrypts the next stage URL.
• In at least one sample, that URL was a published calendar under caldav.icloud[.]com/published/2/.
• The loader opens an anonymous pipe, launches zsh -s, and streams the calendar into it line by line.

The trick relies on zsh being forgiving. Kaspersky explains that "the interpreter treats the lines as invalid commands until it reaches the malicious payload after the DESCRIPTION: line." In the iCalendar format defined in RFC 5545, DESCRIPTION is the free text notes field, so it can hold arbitrary text without breaking the file.

Those commands download a .TAR.GZ archive from iCloud containing another .APP, which the loader unquarantines, signs ad hoc, and runs. Kaspersky's indicator list shows that archive, Loader.app.tar.gz, on a gateway.icloud[.]com path containing /caldav/ and /attach/. Our reading: the payload was stored as a calendar attachment. Two AES encrypted droppers, one with PT_DENY_ATTACH anti debugging, then hand off to scripts that fetch the final modules.

Why Can't Defenders Just Block iCloud?

Defenders cannot block iCloud because the same hostnames serve legitimate calendar sync for every Mac in the fleet. Blocking caldav.icloud.com breaks Calendar for everyone; allowing it means this infection's first hops look like Apple traffic no reputation feed will flag.

Calendar services have done C2 duty before. In May 2025, Google Threat Intelligence Group reported that China's APT41 hid encrypted commands for its TOUGHPROGRESS malware in Google Calendar event descriptions, noting that "misuse of cloud services for C2 is a technique that many threat actors leverage in order to blend in with legitimate activity." A state actor's trick has reached subscription macOS crimeware in roughly 16 months.

Compare the ClickFix payloads hidden in BNB Chain smart contracts across 5,400 hacked sites we covered this month. Takedowns like Google's against APT41 work, but only after the fact, so detection has to happen on the endpoint.

What Does MacSync Steal Once It Lands?

MacSync steals browser cookies and saved logins, wallet data, the Keychain file, Telegram data, shell history, and SSH, AWS, Kubernetes, and Git configs. The Swift stealer phishes the admin password with a fake prompt and checks it through the PAM API rather than dscl, a technique Kaspersky says debuted in July 2026 in Pam Stealer.

The Objective-C backdoor masquerades as Finder and persists three ways:

• A LaunchAgent named com.apple.finder.agent.
• A .zshrc line that runs a .repair-run script whenever zsh starts.
• The same command in the global Git pre-commit and post-checkout hooks.

.repair-run restores deleted files and kills notification processes such as BTMNotificationAgent to suppress the alert macOS 13 and later shows for new launch agents. Backdoor commands arrive as base64 AppleScript, including deploy_ext for browser extensions and deploy_ledger to swap the Ledger app. A live_browser command fetches an sn_relay component Kaspersky suspects intercepts browser traffic.

What This Means for Your Inbox

Stolen browser cookies are the fastest route into webmail: a Gmail or Outlook session cookie can open a mailbox without the password. For developers, that inbox also receives GitHub and cloud console resets.

Public calendars are also built to travel by email. Apple's iCloud documentation says invitees "automatically receive an email that includes the calendar URL" and need no iCloud account to view it. Kaspersky did not report MacSync spreading through invites, but an unexpected caldav.icloud.com link deserves suspicion, not trust.

How Do You Detect MacSync on a Mac?

You detect this chain through process behavior and persistence artifacts, since its early network hops look like ordinary iCloud traffic. Ideas based on Kaspersky's findings:

• A freshly launched app spawning zsh -s with piped input, especially after a request to caldav.icloud.com/published/.
• Calendar downloads by anything other than Apple's own Calendar processes.
• xattr -cr against an app bundle, followed by an ad hoc signed binary running from /tmp/.sys-*.
• A non system process killing NotificationCenter or BTMNotificationAgent.
• Kaspersky verdicts starting HEUR:Trojan.OSX.MacSync, plus the hashes and URLs in the Securelist report.

For a quick manual check, these commands look for the persistence artifacts Kaspersky documented:

# LaunchAgent posing as Finder
ls ~/Library/LaunchAgents /Library/LaunchAgents 2>/dev/null | grep -i com.apple.finder.agent
# Backup directory macOS does not create by default
ls -la "$HOME/Library/Application Support/System"
# Persistence line in zsh startup
grep -n "repair-run" ~/.zshrc
# Global git hooks location (then inspect pre-commit and post-checkout)
git config --global --get core.hooksPath
# Backdoor log file
ls -la ~/Library/Logs/.sysnotif-agent.log

Any hit means compromise: isolate the Mac, then rotate SSH keys and cloud credentials from a clean device.

What Should Mac Users Do Now?

Mac users should treat unsolicited installers and password prompts as the real perimeter.

• Never paste Terminal commands from a website or chat, even ones claiming to install Homebrew or free up disk space.
• Get wallets and developer tools only from the vendor's verified site or the Mac App Store. Toria had a polished site and social accounts and still did not exist.
• Distrust any admin password prompt right after opening a new app, especially one followed by a "damaged app" warning.
• Protect SSH keys with a passphrase or hardware token so a copied ~/.ssh folder is not an instant login.

Kaspersky warns that "MacSync's compromise of software developers' devices poses particular security risks for both end users and corporate systems." GlassWorm's poisoned OpenVSX extensions chased macOS developers for the same reason. A calendar full of shell commands is just the newest delivery van.