This Mac malware is somehow using iCloud calendar invites to try and steal your data

Date:
Fri, 25 Sep 2026 14:40:00 +0000

Description:
A loader talks to iCloud before deploying a sophisticated infostealer and stealing all your cryptos.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Kaspersky uncovers MacSync, a Mac infostealer delivered via iCloud calendar events and fake apps Loader fetches instructions from calendar entries, then deploys malware exfiltrating credentials, wallets, and developer data Newer variants add ObjectiveC backdoor spoofing Finder, persistence, and expanded targeting of crypto and
IT users Cybercriminals have found a way to use iCloud calendar events and cloud storage to deliver a powerful infostealer to Mac devices.

The malware is called MacSync, and its hiding behind fake crypto wallets, or cracked commercial software. Security researchers Kaspersky, who discovered the ongoing campaign, are urging Mac users to exercise caution when downloading programs, especially from third-party websites, and to be very skeptical of apps prompting for their admin password. Latest Videos From TechRadar Watch full video here: Why calendar? Getting people to download and run malware on their devices is not as easy as it sounds.

The victims need to be somehow tricked into downloading and running an app, and even when they do so, chances are the malicious program will be sniffed out by whatever antivirus solutions the device has running, before it can do any meaningful damage. Also, crooks dont want to be forced to repeat the process every time they want to deploy a different variant, or type of malware. You may like This new macOS infostealer poses as an Apple crash reporting tool to try and steal all your valuable data Some Mac users think they're installing OpenAI Codex, but it's actually a malware that can steal passwords in seconds Experts warn this fake Claude install guide can be used to empty crypto wallets

So, they resort to all sorts of techniques and workarounds, from DLL sideloading, to malware loaders.

By separating the initial infection and the actual malware, cybercriminals
can reduce detection rate and get more flexibility, but it creates a new problem: defenders can monitor the traffic going in and out of different apps and thus detect when a loader is deploying malware. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

The challenge then becomes hiding the traffic, and MacSync does it by using the iCloud calendar.

After being downloaded and executed, the loader will reach out to the
calendar - which is a totally benign activity that is unlikely to raise any suspicion - and look for a specific public event, pre-built by the attackers. In its description, it will find the instructions, and the location of, the actual infostealer, and deploy it to ultimately compromise the target device. In this case, the location was also in the iCloud.

The loader itself is being advertised through social media, SEO poisoning,
and phishing. Victims are directed either to fraudulent websites or social media channels promoting cracked software, or free versions of advanced solutions. In at least one example, Kaspersky saw the loader being advertised as a cryptocurrency wallet. Victims are shown a typical ClickFix error, and told to fix it by pasting a command in the Terminal. What to read next ClickLock Stealer tries to trick macOS users into revealing their passwords Security experts targeted by fake crypto conference in scam to hand over details Microsoft smothers malware by tracking behavior instead of blocking domains

The command deploys the loader which, in turn, installs MacSync. A "substantial" overhaul The infostealer emerged in April 2025, and was initially spun out of AMOS, one of the most popular information-stealing variants for the MacOS. It is based on Swift and has, since then, evolved to offer additional capabilities. According to Kaspersky, it can exfiltrate browser history, cookies, saved credentials, cryptocurrency wallet and app data, Telegram data, Keychain data, as well as system and device information. It can exfiltrate SSH, AWS, Kubernetes, Git, and shell configuration files,
as well.

Newer variants come with an Objective-C backdoor spoofing the macOS default file manager, Finder. It establishes persistence, terminates notification processes to prevent alerts, and grants the attackers backdoor access, including running AppleScript received from the C2 server, deploying browser extensions, replacing the legitimate Ledger wallet app, collecting additional system information, and more.

Kaspersky also found an undefined command called live_browser, which
downloads and runs a component named sn_relay, whose point has not yet been established.

The new versions significantly differ from older ones, Kaspersky said, stressing that the attackers substantially overhauled their approach.

The nature of the data attackers seek to collect from a victims device, as well as the categories of applications the stealer disguises itself as, clearly indicates that this malware family primarily targets developers, crypto enthusiasts, and other users associated in some way with IT and the crypto space, the researchers stressed. MacSyncs compromise of software developers devices poses particular security risks for both end users and corporate systems, opening up expanded opportunities for attackers to further their intrusion.

The full list of indicators of compromise (IoC) can be found on this link . The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/this-mac-malware-is-somehow-using-iclou d-calendar-invites-to-try-and-steal-your-data


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)