Home / Technology / Mac Malware Hides in iCloud Calendars
Mac Malware Hides in iCloud Calendars
5 Oct
Summary
- MacSync malware uses public iCloud calendar events.
- It downloads more malicious apps onto Macs.
- Attackers disguise malware as fake crypto wallets.
A sophisticated malware strain named MacSync is now leveraging public iCloud calendar events as part of its attack chain to steal passwords and sensitive files from Macs. Security researchers have identified that malicious commands can be embedded within the description fields of iCloud calendar events.
When a downloader connects to these public calendars, the malware processes the calendar data. While most text is ignored, specific malicious commands can be executed, leading to the download of additional malware onto the victim's Mac. This method cleverly utilizes Apple's infrastructure to conceal attack components.
Earlier versions of MacSync shared similarities with the AMOS stealer, first appearing on the dark web in 2025 under the name Mac.c. This latest iteration, spotted in September 2026, operates on a malware-as-a-service model, allowing various criminals to deploy it using different infection vectors.
Attackers have also disguised MacSync as a fake cryptocurrency wallet called Toria, creating a dedicated website and promoting it on social media platforms like X and Telegram. Once installed, MacSync targets a wide array of sensitive data, including browser history, saved logins, passwords, cryptocurrency wallet information, and system details.
Furthermore, a separate backdoor component, disguised as the macOS Finder app, attempts to maintain persistence through methods like LaunchAgents and configuration file modifications. Researchers have observed commands designed to deploy malicious browser extensions and modify installed wallet applications, raising concerns about the evolving threat landscape for Mac users.
