Full Report
A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads. [...]
Analysis Summary
# Tool/Technique: MacSync (2026 Variant)
## Overview
MacSync is a sophisticated, Swift-based information stealer and backdoor targeting macOS systems. Originally derived from the AMOS (Atomic Stealer) family, it has evolved into a modular threat. The latest variant is notable for utilizing public iCloud calendar event descriptions as a dead-drop resolver and hosting platform for its secondary payloads, bypassing traditional network filtering.
## Technical Details
- **Type:** Malware family (Infostealer / Backdoor)
- **Platform:** macOS
- **Capabilities:** Credential theft, crypto-wallet hijacking, remote command execution (AppleScript), and persistent backdoor access.
- **First Seen:** April 2025 (Initial version); September 2026 (iCloud calendar variant).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link (ClickFix campaigns)
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (LaunchAgents)
- T1546.004 - Event Triggered Execution: .bash_profile and .bashrc
- T1546 - Event Triggered Execution: Global Git Hooks
- **TA0005 - Defense Evasion**
- T1036.005 - Masquerading: Match Legitimate Name or Location (Disguised as "Finder")
- T1564.009 - Hide Artifacts: Resource Fork (iCloud Calendar abuse)
- T1562.001 - Impair Defenses: Disable or Modify Tools (Terminating notification processes)
- **TA0009 - Collection**
- T1539 - Steal Web Session Cookie
- T1555.002 - Credentials from Web Browsers
- T1555.001 - Keychain
- **TA0011 - Command and Control**
- T1102.001 - Web Service: Dead Drop Resolver (iCloud Calendar)
## Functionality
### Core Capabilities
- **Information Stealing:** Targets browser history, cookies, saved credentials, and Keychain files.
- **Exfiltration of Developer Tools:** Steals AWS, Kubernetes, Git, and SSH configuration files.
- **Crypto-Jacking:** Scans for crypto-wallet extensions and application data.
- **Social Engineering:** Prompts users for administrative passwords using fake system alerts.
### Advanced Features
- **iCloud Calendar Integration:** Uses a downloader that parses the `DESCRIPTION:` field of public iCloud calendar events to execute shell commands and fetch payloads.
- **Objective-C Backdoor:** A dedicated module masquerading as the macOS "Finder" process.
- **Persistence Mechanism:** Multi-layered persistence using `LaunchAgents`, `.zshrc` profile modifications, and global Git hooks.
- **Application Replacement:** Capable of replacing legitimate Ledger wallet applications or browser extensions with malicious versions provided by the C2.
- **AppleScript Execution:** Can receive and run arbitrary AppleScript from the C2 server for flexible post-exploitation.
## Indicators of Compromise
- **File Names:**
- `Toria` (Fake crypto wallet)
- `sn_relay` (Unknown component)
- `Finder` (Malicious binary located in non-standard directories)
- **Network Indicators:**
- `icloud[.]com` (Abused for payload delivery)
- `toria[.]io` (Example of a fake campaign domain - *hypothetical/defanged*)
- **Behavioral Indicators:**
- Termination of macOS notification processes to suppress security alerts.
- Execution of `zsh` commands derived from calendar data streams.
- Unauthorized modification of `.zshrc` and Git configuration files.
## Associated Threat Actors
- **ClickFix Campaign Actors:** Known for using fake browser update/fix prompts to distribute macOS malware.
## Detection Methods
- **Signature-based detection:** Scanning for Swift-based binaries with signatures matching the MacSync/AMOS evolution line.
- **Behavioral detection:** Monitoring for `zsh` or `bash` processes attempting to pipe data directly from calendar-related strings or iCloud URLs.
- **Monitoring:** Watch for unexpected additions to `~/Library/LaunchAgents` or modifications to global Git templates/hooks.
## Mitigation Strategies
- **User Education:** Advise users against running commands copied from websites or "fixing" browser issues via terminal scripts (ClickFix).
- **Application Control:** Restrict the execution of unsigned DMG files or applications downloaded from unverified sources.
- **System Hardening:** Use Mobile Device Management (MDM) to monitor and alert on new `LaunchAgents` or modifications to shell profile files.
- **Credential Protection:** Treat all administrative password prompts with high scrutiny, especially when appearing outside of expected system updates.
## Related Tools/Techniques
- **AMOS (Atomic Stealer):** The predecessor/base family for MacSync.
- **Dead Drop Resolvers:** Similar to techniques using YouTube comments or GitHub READMEs to host C2 instructions.
- **ClickFix:** The delivery framework used to social-engineer users into infecting their own systems.