MacSync now pipes a public iCloud calendar into zsh to stage its Mac payload

The first-stage binary hides its next-stage URL in its own overlay and reads that overlay back to front. It locates the marker `SONOMAC1` at the tail, reads the 8 bytes in front of the marker as a length, then uses that length to bound the XOR ciphertext ^[16][17]. The key is ten bytes and spells `sonomabld` in ASCII, followed by 0x07 ^[1].

In at least one sample the decrypted URL was a public iCloud calendar ^[18]. The downloader opens an anonymous pipe, starts `zsh -s`, and feeds the calendar file into its standard input line by line ^[19]. The shell rejects the calendar's own lines as invalid commands and keeps reading until it reaches the payload after the `DESCRIPTION:` line. Those commands pull a .tar.gz archive from iCloud ^[20].

Kaspersky's stated change is that binary droppers replaced script-based ones and the payload modules are now written in Objective-C and Swift ^[4][5]. Scripting is still in the chain. In one build of the same fake application the DMG carried a compiled JXA script that decoded a shell script and passed it straight to the interpreter without writing it to disk; in another build of the same app, that script ran later, after a chain of droppers and loaders ^[11]. Coverage tuned to the AppleScript versions of 2025 is still pointed at the right layer ^[2], but the script now arrives compiled inside a FAT Mach-O that runs on Apple silicon and Intel alike ^[14].

Every temporary file goes in /tmp, including the .lock files that stop a second run, and each module deletes its temp files and its own logs once it finishes ^[12][13]. Before any of that, the .APP checks whether its bundle carries `com.apple.quarantine` and runs `xattr -cr` to strip all extended attributes ^[15]. That check and strip happens first in the chain. It is the earliest step visible in process telemetry.

MacSync is rented, so the first stage belongs to whoever rents it ^[7]. Kaspersky's own sighting was a nonexistent crypto wallet called Toria, with a dedicated web page and promotion on X and Telegram ^[9]; earlier public reporting on the family concentrated on social engineering and ClickFix-style attacks, and cracked-app installers have carried it throughout ^[8]. Hash-blocking one campaign's DMG leaves the next operator's lure untouched. The account is Kaspersky's own telemetry, published with four MacSync verdict families ^[21][2].