A new version of MacSync, an information stealer built for macOS, now fetches its next instructions from the description of a public iCloud calendar event, BleepingComputer reported on 24 September, citing research by Kaspersky. It is a clever trick: to anything watching the network, the Mac is just talking to Apple.
What MacSync is
MacSync is written in Swift and first appeared in April 2025. According to Kaspersky, early versions were derived from the AMOS stealer family before it grew its own modules. It has reached victims through social engineering: ClickFix-style pages that talk people into pasting a command into Terminal, fake Homebrew and disk-space analyser tools, and software presented as free, cracked or brand new. In this campaign it also posed as a crypto wallet called Toria, with its own website and social-media promotion.
How the calendar trick works, in plain words
In the more complex of the two delivery methods Kaspersky found, a small downloader reads a public iCloud calendar event and hands its text to zsh, the Mac’s command shell. Most of that text is gibberish that produces errors, but the commands placed after the event’s DESCRIPTION line run. They fetch an archive from iCloud containing an app bundle that acts as a dropper, which in turn pulls down the stealer itself.
The stealing part is largely unchanged: browser history, cookies and saved passwords, crypto wallet extensions and app data, Telegram data, the Keychain file, system information, and developer secrets such as SSH, AWS, Kubernetes, Git and shell configuration files.
What is new is a backdoor written in Objective-C that disguises itself as Finder. Its installer makes it start again after every reboot through a LaunchAgent, changes to the .zshrc file and global Git hooks, and it terminates macOS notification processes so alerts don’t reach the user. The backdoor can run AppleScript sent by its operators, install a browser extension or swap an installed Ledger wallet app for a tampered one, and upload files and system details to its command server. Kaspersky inferred these actions from command names and status messages; one command, live_browser, fetches a component whose purpose it could not determine.
Does this affect you?
Only if you run it. MacSync does not break in on its own: every route described in the report starts with a person pasting a command, opening a download from an untrusted site, or typing an administrator password when asked. That is good news, because it means habits stop it.
What to do today
- Never paste a command from a web page, a “CAPTCHA”, a chat or a video into Terminal. No legitimate site needs you to do that to prove you are human or to fix an error.
- Download apps, including crypto wallets, only from the developer’s own site or the App Store, and be suspicious of DMG files from sites you reached through ads or social media.
- Treat an unexpected administrator password prompt as a stop sign, not a formality.
- Check System Settings › General › Login Items & Extensions, and the LaunchAgents folder in your Library, for anything you don’t recognise.
- If you use Git, run git config --global core.hooksPath in Terminal: it normally prints nothing. A path you didn’t set is worth investigating.
- Keep macOS up to date so Apple’s built-in protections have the latest signatures.
Where FireAI fits, and where it doesn’t
A stealer is only useful to its operator once it sends what it found. That moment is a network connection, and it is the moment FireAI is built for:
- The first time an app you’ve never approved, such as a “wallet” you just installed or a dropper hiding in an app bundle, tries to reach the internet, FireAI asks you, names the app and shows where it’s going on the world map.
- In Paranoid mode, unsigned apps are blocked and even Apple’s own command-line tools, like the ones a pasted Terminal command uses to download files, must be approved like any other app.
- Clipboard Armor adds a warning sign in Investigate when an app’s first connection lands seconds after your clipboard changed, the pattern a “copy this command” trick leaves behind.
- FireAI’s own AI explains each connection on your Mac, so “Finder is connecting to a server in a country you’ve never heard of” reads as the red flag it is.
Honest limits: a firewall does not remove a stealer, and code you have already given your administrator password to can try to interfere with any security tool on the machine. FireAI’s strength is the moment before the data leaves. If you suspect an infection, disconnect, change your passwords from another device, and have the Mac checked.
Want to see which apps on your Mac talk to the internet right now? Download FireAI and try it free for 17 days. FireAI is made by HisnLabs.