A new variant of the **MacSync** info-stealing malware, targeting **macOS** systems, has been observed leveraging public **iCloud** calendar events to deliver fresh payloads. **MacSync**, a Swift-based malware first identified in April 2025, has previously been distributed through **ClickFix** campaigns, often disguised as legitimate tools like **Homebrew** or **macOS** disk space analyzers. Researchers at **Kaspersky** note that while earlier iterations of **MacSync** were derived from the **AMOS** stealer family, the malware has significantly evolved, integrating new capabilities through modular additions. ### Evolving Delivery Chains **MacSync** has historically relied on social engineering tactics, including **ClickFix**-style attacks, and distribution via software presented as free, cracked, or novel applications. One notable campaign involved the malware being disguised as a fake crypto wallet named **Toria**, complete with a dedicated website and social media promotion. The latest **Kaspersky** findings detail two primary delivery methods. The more complex method involves a downloader fetching commands hidden within the description fields of public **iCloud** calendar events. These commands then facilitate the download of the next-stage payload, also from **iCloud**. The downloader feeds the retrieved calendar data to **macOS**'s **zsh** shell. Although most of the calendar text generates errors, specific commands placed after the event’s `DESCRIPTION:` line are executed, leading to the download of an archive containing the malware components. This archive typically includes an 'APP' bundle that acts as a dropper, initiating further stages that ultimately retrieve the **MacSync** malware.  ### A Potent New Backdoor Module The infostealer module within **MacSync** remains largely consistent, targeting sensitive data such as browser history, cookies, saved credentials, crypto wallet extensions and app data, **Telegram** data, the **Keychain** file, system and device information, and configuration files for **SSH**, **AWS**, **Kubernetes**, **Git**, and shell environments.  A significant new addition is an **Objective-C** backdoor module. This module masquerades as **Finder**, the default file manager on **macOS**. Its installer establishes persistence through a **LaunchAgent**, modifications to `.zshrc`, and global **Git** hooks. To further evade detection, it terminates **macOS** notification processes, preventing users from receiving alerts. This backdoor grants attackers a range of capabilities on infected systems, including: * Executing attacker-supplied **AppleScript** received from its command-and-control (**C2**) server. * Deploying malicious browser extensions or replacing legitimate **Ledger** wallet applications with compromised versions from the **C2** server. * Collecting additional system information and files, uploading them to the **C2** server. * Ensuring persistence to restart automatically after a system reboot. **Kaspersky** researchers inferred the purpose of these commands from their names and status messages, as the specific **AppleScript** code executed by them was not available. They also identified a mysterious `live_browser` command, which downloads and executes a component named `sn_relay`, whose exact function remains unknown. As **MacSync** continues to evolve with more evasive and effective distribution methods, **macOS** users are strongly advised to exercise caution. Avoid executing commands found online, refrain from downloading **DMG** files from untrusted sources, and treat all administrative password prompts with extreme scrutiny.