A Public Apple Calendar as Command-and-Control
Kaspersky researchers have documented a new infection chain for MacSync, a Swift-based macOS infostealer that first emerged in April 2025 as a derivative of the AMOS ("Atomic") stealer family. Reported by BleepingComputer on September 24, 2026, the latest campaign abuses public iCloud calendars as a covert delivery and command channel, and pairs the existing infostealer module with a new Objective-C backdoor that impersonates macOS Finder.
Details
| Attribute | Value |
|---|---|
| Malware Family | MacSync (Swift-based, derived from AMOS/Atomic stealer) |
| First Observed | April 2025 |
| New Technique Reported | September 24, 2026 |
| Platform | macOS |
| Discovered By | Kaspersky researchers |
| New Component | Objective-C backdoor module disguised as Finder |
| Delivery Mechanism | Commands hidden in public iCloud calendar event descriptions |
How the New Delivery Chain Works
Commands hidden inside calendar events
Instead of relying solely on malicious ads, cracked-software sites, or fake update prompts, the updated MacSync downloader fetches its next instructions from public iCloud calendar event descriptions. Because iCloud calendars are a legitimate Apple service, traffic to and from them blends into normal user activity and is far less likely to be flagged by network security tooling than a traditional attacker-controlled domain.
From calendar text to shell commands
The infection proceeds in stages:
- A lightweight downloader queries a public iCloud calendar and retrieves event data.
- Text placed after the
DESCRIPTION:field in the calendar event is extracted and fed directly to macOS's zsh shell for execution. - Those commands instruct the system to download an archive hosted on iCloud.
- The archive contains an app-bundle dropper that installs the next malware stages.
- The dropper ultimately deploys the full MacSync payload onto the compromised Mac.
A backdoor that impersonates Finder
The campaign's new Objective-C backdoor module disguises itself as the macOS Finder application to avoid raising suspicion. Once running, it gives attackers the ability to:
- Execute arbitrary AppleScript commands on the infected machine
- Deploy malicious browser extensions, or replace the legitimate Ledger hardware-wallet application with a trojanized version
- Collect files from the system and upload them to attacker-controlled command-and-control (C2) infrastructure
- Maintain persistence across reboots
What the infostealer module still captures
Alongside the new backdoor, MacSync's core infostealer functionality remains active, harvesting:
- Browser history, cookies, and saved credentials
- Cryptocurrency wallet data
- Telegram account information
- SSH, AWS, Kubernetes, and Git configuration files
Impact Assessment
| Impact Area | Description |
|---|---|
| Credential theft | Browser-stored logins, cookies, and session data can be harvested and reused for account takeover |
| Cryptocurrency loss | Wallet data theft and Ledger app replacement directly target crypto holdings |
| Cloud/DevOps exposure | Stolen SSH, AWS, Kubernetes, and Git configs can enable lateral movement into developer and cloud infrastructure |
| Long-term persistence | The Finder-spoofing backdoor survives reboots and can pull in additional payloads (browser extensions, further malware) on demand |
| Detection evasion | Using a legitimate Apple cloud service (iCloud Calendar) for C2-style command delivery makes network-based detection significantly harder than flagging traffic to a known-bad domain |
Recommendations
For macOS users
- Never copy and run commands found online — in forums, ads, "fix" pages, or software cracks — without understanding exactly what they do.
- Avoid downloading DMG files from unofficial or suspicious sites; only install software from the Mac App Store or a vendor's verified official site.
- Treat unexpected macOS administrator password prompts as a red flag, especially after installing software from an unfamiliar source, and cancel if the context doesn't clearly justify the request.
- If you use a Ledger or similar hardware wallet, verify the application's integrity (checksum or official download source) if you have any reason to suspect compromise.
For security teams
- Add detection logic for zsh processes spawned from downloader utilities that fetch content from
icloud.comcalendar endpoints, particularly where shell execution follows immediately after a network fetch. - Monitor for unsigned or newly-appeared applications named or disguised as "Finder" that are not Apple's system Finder process.
- Extend browser-extension allowlisting and monitoring on managed macOS fleets, since the backdoor's persistence path includes deploying malicious extensions.
- Review EDR telemetry for AppleScript execution originating from non-standard parent processes, a key capability of the new backdoor module.
Key Takeaways
- MacSync, active since April 2025 as an AMOS-derived macOS stealer, has gained a new delivery chain that hides attacker commands inside public iCloud calendar event descriptions.
- The technique abuses a legitimate Apple cloud service to blend malicious command delivery in with normal traffic, complicating network-based detection.
- A new Objective-C backdoor disguised as Finder adds AppleScript execution, malicious browser-extension deployment, Ledger wallet-app replacement, and file exfiltration to MacSync's capabilities.
- The malware's existing infostealer module continues to target browser data, cryptocurrency wallets, Telegram data, and cloud/DevOps credentials (SSH, AWS, Kubernetes, Git).
- Defenders should treat unsolicited shell commands, unofficial DMG downloads, and unexpected admin-password prompts as core risk indicators, and add detection for iCloud-calendar-driven command execution.