MacSync is a macOS cryptocurrency and information stealer sold under the malware-as-a-service (MaaS) model, first advertised on dark-web forums in 2025 as 'Mac.c' and rebranded to MacSync around September 2025. Early builds were AppleScript droppers closely resembling the AMOS (Atomic macOS Stealer) family; the family has since added a full remote-access backdoor alongside the stealer. In September 2026 Kaspersky (Securelist, Sergey Puzan) documented a substantially reworked version, first observed in the wild that month, whose infection chain has grown to six stages and whose second stage is, in at least one variant, hosted on Apple's own iCloud CalDAV infrastructure rather than attacker-controlled infrastructure.

Delivery is operator-dependent, consistent with MaaS. Observed lures are malicious DMG disk images disguised as free or cracked versions of popular applications and as new software, including the entirely fictitious 'Toria' crypto-wallet application promoted through a dedicated website and on X and Telegram. Two delivery variants were observed within a single fake-app campaign: one where a compiled JXA (JavaScript for Automation) script inside the DMG decodes a shell script and passes it straight to the interpreter without ever writing it to disk, and one that traverses a longer chain of droppers and loaders.

In the longer chain, a stage-one .APP on the disk image strips the com.apple.quarantine attribute with 'xattr -cr', reads an XOR-encrypted URL from its Mach-O overlay (XOR key 73 6f 6e 6f 6d 61 62 6c 64 07, magic SONOMAC1, read backwards as magic, then 8-byte length, then ciphertext), and downloads a second-stage script. In the iCloud variant that URL is a published iCloud calendar: the downloader creates an anonymous pipe, launches 'zsh -s' with the pipe as stdin, and feeds the calendar lines in - the lines are invalid commands until the payload following the DESCRIPTION: line, which downloads a .TAR.GZ from an iCloud CalDAV attachment containing an .APP bundle. That app is stripped of extended attributes, ad-hoc signed and executed. Stage three drops a zlib-compressed, AES-CBC-encrypted executable at /tmp/.sys-<16-digit random value>; stage four adds anti-debugging (VM checks via sysctl on kern.hv_vmm_present and machdep.cpu.brand_string, and ptrace with PT_DENY_ATTACH) and runs an AES-CBC-encrypted shell script; stage five fetches the next stage from the C2, decrypts it with AES-CBC and executes it in memory; stage six downloads the infostealer, the backdoor and the pkgunpack utility, sets persistence and uploads stolen data, with modules arriving as .TAR.GZ that are extracted, stripped of extended attributes and ad-hoc signed.

The infostealer is a Swift binary that impersonates the application the user believed they were installing, prompts for the macOS administrator password, and verifies it through the PAM API rather than the dscl utility - a comparatively new technique in macOS malware. It harvests browser history, cookies, crypto-wallet extension data, saved logins and Local State files, crypto-wallet application data, Telegram data, the device login and password, the Keychain, installed applications, running processes, hardware and UUID details, and SSH/ZSH/AWS/Kubernetes/GIT configuration files, along with ZSH and Bash command history and the current user profile picture. Keychain partition_id lists are rewritten via 'security set-generic-password-partition-list' so that entries are readable by apple:, apple-tool: and specific team IDs (for example EQHXZ8M8AV for Chrome Safe Storage and KL8N8XSYF4 for Brave Safe Storage) without a user confirmation prompt.

The Objective-C backdoor masquerades as the Finder application, lives under $HOME/Library/Application Support/System (not a default macOS directory), logs to $HOME/Library/Logs/.sysnotif-agent.log, and persists as the LaunchAgent com.apple.finder.agent, additionally adding itself as a Login Item and injecting a command into .ZSHRC. A .repair-run script invoked from .ZSHRC and from global GIT pre-commit and post-checkout hooks restores missing backdoor files from backup and recreates and reloads the LaunchAgent. Its HTTP C2 exposes deploy_ext (browser-extension deployment), deploy_ledger (replacement of the Ledger wallet application), regrab (re-collection of system information and specific files) and live_browser (a relay/MitM on victim browser traffic, the only command that is not an AppleScript); all other commands execute a base64 AppleScript supplied by the server's script_b64 field. Beaconing uses GET /v1/agent/ping with tag (victim ID plus build number) and build, where a 403 means an expired token, refreshed via POST /v1/agent/refresh; stolen data is uploaded with POST /v1/asset/<upload_id>/init (size in X-File-Size, SHA-256 in X-File-Sha256) followed by PUT /v1/asset/<upload_id> in 90-megabyte chunks, all gated by a custom X-Upload-Token header. Data keys are wrapped with ECDH over Curve25519 (curve25519_donna) and AES-GCM, with buffers zeroed after use at each stage to hinder forensics and dynamic analysis.

Attribution: Kaspersky presents MacSync as a MaaS product and does not name an operator. Independent reporting on the SONOMAC1/'Sonoma' cluster - which shares the same campaign apex domains (appstore.com.mx, apple03cloudstore.com), the same iCloud CalDAV staging technique, the same /tmp/osalogging.zip staging artefact and the same pkgunpack/Curve25519/AES-GCM tooling - attributes that operation to the 'Crazy Evil' traffer team (named sub-teams DEFI, ZOOMLAND, AVLAND, KEVLAND), whose tooling previously delivered AMOS-style stealers behind fake Loom downloads. Attribution is assessed at MEDIUM confidence: the infrastructure overlap is strong and independently reported, but no vendor has formally merged the two family names, and MacSync is explicitly distinct from PamStealer/'Avenger' (Jamf, July 2026), another macOS stealer that also abuses the PAM API - 'PAM' describes an API, not a family.

Detection relevance: the family's durable, rotation-resistant signals are behavioural rather than domain-based - curl fetching /curl/<token> or /dynamic?txd=, exfiltration via PUT to /gate?buildtxd= with upload_id/chunk_index/total_chunks parameters and an api-key header, osascript executing shell utilities (sh, cp, rm, curl, mkdir, killall, dscl), xattr -cr followed by ad-hoc codesign and open -gn, staging under /tmp/.sys-*, /tmp/.ldr-*, /tmp/.pkgunpack-*, /tmp/.core-*.enc and /tmp/osalogging.zip, and any outbound request to *.icloud.com/caldav/.../attach/ piped into tar. Microsoft documented that correlating these traits connected more than 30 rotating domains, and RST Cloud showed a static api-key value binding four confirmed C2 domains across separate deployments while the per-build token rotated. BeaconBeagle returned no C2-framework configuration match for the network indicators checked (85.206.161.241, 103.216.221.95, agenticsora.com, toria.apple03cloudstore.com, docsend.appstore.com.mx), consistent with a bespoke HTTP C2 rather than a commodity framework such as Cobalt Strike or Sliver.