Security2 publishers2 min readPublished Updated
MacSync hides its next-stage commands in public iCloud calendar events
Kaspersky says a new MacSync variant hides its payload commands in public iCloud calendar events and downloads the next stage from iCloud. Both the instructions and the download ride trusted Apple domains, past defenses that block known-bad hosts.
The Watch · Security desk
What happened
- Kaspersky ties MacSync's earlier versions to the AMOS stealer family and says the malware later moved its capabilities into modules.
- A new Objective-C backdoor disguises itself as Finder, persists through a LaunchAgent, .zshrc edits and global Git hooks, and kills macOS notification processes so the user sees no alerts.
- Kaspersky flagged a 'mystery' command called live_browser that runs a component named sn_relay whose purpose the researchers could not determine.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint With both the command channel and the payload hosted on iCloud, a blocklist of known-bad domains has nothing to match; the traffic goes to Apple.
- exposure The backdoor can swap an installed Ledger wallet app for a C2-supplied version, putting a victim's crypto at direct risk.
- decision Detection shifts from host reputation to behavior: a trusted Apple service feeding text into zsh becomes the thing to watch.
The trick is where the two halves of the delivery live. In the more complex of two chains Kaspersky found, a downloader reads its instructions from the description field of a public iCloud calendar event, then pulls the next-stage archive from iCloud as well [6]. Both hops go to Apple. A blocklist built from known-bad domains has nothing to match.
The calendar text is fed straight into zsh. Most of it produces errors. The working commands sit after the event's DESCRIPTION: line and fetch an archive of malware components [7]. That archive carries an APP bundle that acts as a dropper for later stages, and those stages end in MacSync [8].
MacSync is not new. It is Swift-based, surfaced in April 2025, and Kaspersky traces its earlier builds to the AMOS stealer family before the author moved capabilities into modules [2][4]. Recent rounds arrived through ClickFix lures posing as Homebrew and a macOS disk-space analyzer, and through a fake crypto wallet called Toria that had its own site and social-media promotion [3][5].
The stealer module is unchanged. It still takes browser history, cookies and saved credentials, crypto wallet data, Telegram data, the Keychain file, and SSH, AWS, Kubernetes, Git and shell configuration files [9]. The new piece is an Objective-C backdoor that poses as Finder. It persists through a LaunchAgent, .zshrc edits and global Git hooks, and it kills macOS notification processes so the user sees no alerts [10]. From its C2 it can run attacker-supplied AppleScript, install a browser extension, replace an installed Ledger wallet app with a version the C2 supplies, and upload files [11].
Kaspersky did not have the AppleScript itself, so it read the commands' purpose from their names and status messages [12]. One command, live_browser, downloads and runs a component called sn_relay that the researchers could not identify [13].
The advice is narrow: do not paste commands you find online into a terminal, avoid DMG files from unfamiliar sites, and treat admin password prompts with caution [14]. The harder problem is upstream. When the C2 channel and the payload both ride iCloud, there is no bad domain to flag; what defenders can still see is a trusted Apple service feeding text into a shell [6][7].
What to watch
- Whether Apple restricts programmatic reads of public calendar event descriptions or the iCloud paths used for staging.
- Whether Kaspersky or others recover the AppleScript and identify what the sn_relay component does.
- Whether the same trusted-service delivery pattern turns up in other macOS stealers beyond MacSync.