News Date: 2026-09-24
A new version of the MacSync information stealer is using public iCloud calendar events to retrieve commands and deliver additional malware to macOS computers. The campaign shows how attackers can hide operational instructions inside legitimate cloud services that users and network controls may be reluctant to block.
Commands Concealed in Calendar Events
MacSync is a Swift-based threat first observed in 2025 and has previously appeared in social-engineering campaigns that impersonated Homebrew, disk-management tools and other applications. In the newly documented activity, the malware was also presented as a cryptocurrency wallet named Toria and promoted through a dedicated website and social media.
In the more complex infection chain, a downloader accesses the description field of a public iCloud calendar event. Content following a specific description marker is passed to the macOS zsh shell, which executes embedded instructions and downloads an archive containing the next stage.
This approach does not mean iCloud itself has been compromised. Instead, the attackers are abusing a legitimate content-hosting feature as a dead-drop location. The malware only needs to retrieve publicly accessible information, making the traffic potentially harder to distinguish from normal cloud activity.
Broad Theft and Persistent Backdoor Access
The information-stealing component targets browser histories, cookies, saved credentials, cryptocurrency wallets, Telegram data and the macOS Keychain. It also searches for SSH material, AWS credentials, Kubernetes configuration, Git data and shell files, making infected developer workstations particularly valuable.
Researchers also identified an Objective-C backdoor disguised as Finder. It can establish persistence through LaunchAgents, shell configuration changes and global Git hooks. The module can execute AppleScript, collect files and replace browser extensions or an installed Ledger wallet application with attacker-controlled versions.
Recommended Controls
- Prevent users from running copied terminal commands from websites or unsolicited instructions.
- Restrict software installation to trusted and managed sources.
- Monitor new LaunchAgents, global Git hooks and unexpected changes to shell configuration files.
- Investigate unusual password prompts and applications impersonating Finder.
- Rotate cloud and developer credentials after a suspected infection.
I believe the developer-secret collection is the most serious enterprise concern. A compromised Mac may provide access not only to personal accounts but also to source repositories, cloud environments and deployment systems. Security teams should therefore treat suspicious macOS activity as a potential starting point for a wider infrastructure breach.