MacSync malware used an iCloud Calendar file after a malicious app ran

A newly documented MacSync infection chain used a public iCloud Calendar file to help retrieve malware after a user had already launched a malicious Mac application, according to Kaspersky. The finding does not show that receiving or opening an ordinary calendar invitation can infect a Mac.

That distinction matters because the calendar file was an intermediate stage, not the initial lure. In the campaign Kaspersky analysed, malicious disk images included an application impersonating a nonexistent Toria cryptocurrency wallet promoted through X and Telegram. Only after the application ran did one observed loader retrieve content from iCloud.

Kaspersky announced the updated MacSync version on 17 September 2026 and published its detailed technical analysis on 24 September. The company said it had first seen the new infection chain in the wild during September.

How the iCloud stage worked

In at least one analysed sample, an early loader fetched a publicly accessible iCloud Calendar file in ICS format. It processed content associated with the file’s description field, which supplied instructions for downloading a subsequent archive. Later stages installed a Swift information stealer and an Objective-C backdoor.

This is better understood as post-execution staging than as delivery through a calendar invitation. The user had already been persuaded to download and run a malicious application. Kaspersky also found samples that obtained their next-stage content directly from an attacker-controlled server, showing that the calendar mechanism was not used across every chain it examined.

MacSync is offered through a malware-as-a-service model, according to Kaspersky and the Center for Internet Security. Individual operators can therefore select different lures and first-stage delivery methods. The public calendar technique represents one newly observed option, rather than a universal account of how MacSync reaches users.

Using a legitimate cloud endpoint may make simple controls based only on a domain’s reputation less useful. However, the research does not establish that the iCloud route consistently defeated any particular security product. The chain also involved observable behaviour before and after the calendar retrieval, including execution of the malicious application, subsequent downloads and the creation of persistence mechanisms.

Credentials, wallets and developer data at risk

Kaspersky said the infostealer prompts the user for an administrator password and targets browser history, cookies and saved credentials. It also seeks cryptocurrency wallet material, Telegram data, the macOS Keychain file, system information, shell history, and developer or cloud configuration associated with services and tools including SSH, AWS, Kubernetes and Git.

The combination of a fake wallet lure and the data selected for collection makes cryptocurrency users and developers particularly relevant audiences. Kaspersky has described those groups as primary targets, but it did not publish victim demographics or prevalence figures. They should not be treated as the only users who could be affected.

The accompanying backdoor establishes persistence through mechanisms involving a LaunchAgent, shell startup configuration and global Git hooks. Kaspersky identified command handlers associated with deploying browser extensions, replacing a Ledger wallet application and collecting data again. However, the researchers did not possess the AppleScript payloads used by those handlers and could not determine the purpose of a component called live_browser.

The analysed binaries were built to target both Apple Silicon and Intel Macs. Kaspersky did not establish a complete list of affected or unaffected macOS versions, and the research did not identify an Apple software vulnerability in the chain. It instead describes social engineering, execution of malicious software and abuse of legitimate cloud hosting.

Different MacSync campaigns used different lures

The new disk-image chain should also be kept separate from earlier MacSync activity. The Center for Internet Security documented a confirmed infection at a US state, local, tribal or territorial organisation that involved search engine optimisation poisoning, a fake CAPTCHA and instructions to paste a command into Terminal.

Both reports concern MacSync, but they do not establish one fixed infection sequence. The malware-as-a-service model allows operators to vary their delivery tactics, and the earlier confirmed infection does not independently confirm use of the newer iCloud stage.

The available research also does not establish how many people encountered the newly analysed chain, whether any specific victim lost data through the calendar-based variant, or whether financial losses occurred. No named criminal group, state or country has been attributed as its operator. Reverse-engineered collection capabilities show what the malware is designed to access, not what was taken from an identifiable victim.

What Mac users and security teams can do

The research identifies no relevant software patch because the documented chain does not depend on a disclosed macOS flaw. Immediate precautions include avoiding applications from unverified suppliers, cracked software, newly promoted wallet applications and lookalike download sites. Users should not paste commands into Terminal because a website, fake CAPTCHA, installer or error message tells them to do so.

An unexpected request for an administrator password from a newly downloaded application, particularly if followed by a message claiming the application is damaged, is a reason to stop and investigate. Receiving an unsolicited calendar invitation alone is not evidence that MacSync is present.

Kaspersky published hashes and infrastructure indicators that security teams can use for retrospective searches, although those indicators cover observed samples and can change. If a suspected application ran, defenders should examine the documented LaunchAgent, shell startup and Git hook persistence locations. Removing only the visible application may leave the backdoor components described in the research untouched.

Distinguishing entry, retrieval and persistence helps readers interpret a malware chain without mistaking an intermediate service for the initial route. Study the supporting technical concepts through The Hack Academy’s online cybersecurity training programme, with self-paced learning in cybersecurity fundamentals and networking, plus practical exercises alongside theory.