# MacSync information stealer retrieves commands from public iCloud calendar events

> A MacSync variant reads its commands from a public iCloud calendar event, steals credentials and crypto wallets, and installs a backdoor disguised as Finder.

HisnLabs Security & Research Team (HisnLabs) · Published 2026-09-26
Canonical: https://hisnlabs.com/en/news/macsync-stealer-icloud-calendar-mac

A new version of MacSync, an information stealer built for macOS, now retrieves its next instructions from the description field of a public iCloud calendar event, [BleepingComputer reported](https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/) on 24 September, citing research from Kaspersky. Because the request goes to Apple's own servers, the technique lets the stealer's traffic pass as ordinary iCloud activity. The same report describes a new backdoor component and a crypto-wallet lure used to distribute it.

## Background

MacSync is written in Swift and first appeared in April 2025. Kaspersky says early versions were derived from the AMOS stealer family before MacSync's authors built their own modules [[1]](https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/). It has reached victims through social engineering: ClickFix-style pages that talk people into pasting a command into Terminal, fake Homebrew and disk-space analyser tools, and software presented as free, cracked or newly released. In the campaign BleepingComputer describes, MacSync also posed as a crypto wallet called Toria, with its own website and social-media promotion.

## Findings

In the more complex of two delivery methods Kaspersky found, a small downloader reads a public iCloud calendar event and passes its text to zsh, the shell macOS runs Terminal commands in. Most of the event's text is unrelated content that produces shell errors, but the lines placed after the event's DESCRIPTION field execute. They fetch an archive from iCloud containing an app bundle that acts as a dropper, which then downloads the stealer itself [[1]](https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/).

The data MacSync collects is largely unchanged from earlier versions: browser history, cookies and saved passwords, crypto-wallet extensions and app data, Telegram data, the Keychain file, system information, and developer credentials such as SSH, AWS, Kubernetes, Git and shell configuration files [[1]](https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/).

Kaspersky also found a new backdoor, written in Objective-C, that disguises itself as Finder. Its installer sets it to relaunch after every reboot through a LaunchAgent, edits the .zshrc file and global Git hooks, and terminates macOS notification processes so alerts do not reach the user. Kaspersky inferred from command names and status messages that the backdoor can run AppleScript sent by its operators, install a browser extension, replace an installed Ledger wallet app with a tampered one, and upload files and system details to a command server [[1]](https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/).

> A stealer only becomes useful once it phones home. Try FireAI free for 17 days: a new app has to ask before it connects to the internet. [Download FireAI for Mac](https://hisnlabs.com/fireai/en/download)

## Implications for Mac users

MacSync does not install itself. Every route BleepingComputer describes starts with a person pasting a command, opening a download from an untrusted site, or entering an administrator password when asked. Users who never do those things are not exposed by this campaign as reported. Users who install pirated software, follow "fix this error" instructions from a web page, or download a crypto wallet from outside the developer's own site or the App Store are the ones at risk [[1]](https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/).

## Recommendations

1. Never paste a command from a web page, a "CAPTCHA", a chat or a video into Terminal. No legitimate site needs that to prove you are human or to fix an error.
2. Download apps, including crypto wallets, only from the developer’s own site or the App Store, and treat DMG files from ads or social-media links with suspicion.
3. Treat an unexpected administrator-password prompt as a reason to stop, not a formality.
4. Check System Settings › General › Login Items & Extensions, and the LaunchAgents folder in your Library, for anything you do not recognise.
5. If you use Git, run `git config --global core.hooksPath` in Terminal. It normally prints nothing; a path you did not set is worth investigating.
6. Keep macOS up to date so Apple’s built-in protections have current signatures.

## Relevance to FireAI

A stealer is only useful to its operator once it sends what it collected, and that moment is a network connection. When an app that has never been approved, such as a newly installed "wallet" or a dropper hidden in an app bundle, tries to reach the internet, FireAI asks about it, names the app and shows the destination on the [world map](https://hisnlabs.com/fireai/en/docs/world-map). In [Paranoid mode](https://hisnlabs.com/fireai/en/docs/security-modes), unsigned apps are blocked, and Apple's own command-line tools, the ones a pasted Terminal command relies on to download files, must be approved like any other app. [Clipboard Armor](https://hisnlabs.com/fireai/en/docs/clipboard-armor) flags an app's first connection when it lands seconds after the clipboard changed, the pattern a "copy this command" page leaves behind.

FireAI does not remove a stealer already running on a Mac, and it cannot stop code that a person has already granted an administrator password from interfering with other software on the machine. Its role is the connection before data leaves. Anyone who suspects an infection should disconnect the Mac, change passwords from a separate device, and have the machine checked.

> Want to see which apps on your Mac talk to the internet right now? Try FireAI free for 17 days. [Download FireAI for Mac](https://hisnlabs.com/fireai/en/download)

## Limitations

This account rests on a single report, drawing on Kaspersky's research; it has not been independently corroborated here. Kaspersky inferred most of the backdoor's capabilities from command names and status strings rather than from observing every function run, and it could not determine what one command, live_browser, actually fetches or does [[1]](https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/). BleepingComputer's report does not state how many Macs have been affected, nor whether Apple's built-in XProtect signatures currently cover this MacSync variant.

Try [FireAI, by HisnLabs](https://hisnlabs.com/fireai/en/download) free for 17 days.

## Sources

- [BleepingComputer (Bill Toulas), 24 September 2026: MacSync uses public iCloud calendars to deliver new payloads](https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/)