MacSync macOS infostealer/backdoor: reworked MaaS chain stages stage-two via a public iCloud calendar (SONOMAC1)

Key facts

Detection coverage

As of 2026-09-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2637 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MacSync Backdoor Persistence - Fake Finder LaunchAgent, Backdoor Home Directory and Shell Profile Injection

Detects the MacSync backdoor persistence footprint. The Objective-C backdoor masquerades as the Finder application, persists as the LaunchAgent com.apple.finder.agent and in related builds as ~/Library/LaunchAgents/com.apple.<8 hex>.hcpi.plist, keeps its payload in $HOME/Library/Application Support/System, deliberately not a default macOS location, and re-establishes itself by injecting commands into .ZSHRC plus a .repair-run script that is also invoked from global git pre-commit and post-checkout hooks. These are file-system artefacts, so they are detectable without any network visibility and survive C2 rotation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1543.001, T1546.004, T1546, T1036.005, T1074.001
• Data sources: macos:osquery (file_events, launchd), DeviceFileEvents (Defender for Endpoint on macOS), macos:unifiedlog (subsystem com.apple.launchservices)
• Severity: critical
• Confidence: high

Splunk SPL

index=macos sourcetype="macos:osquery" (file_events OR launchd)
| search ("Library/LaunchAgents" AND ".plist") OR "Application Support/System" OR ".zshrc" OR ".repair-run" OR ".hcpi"
| eval indicator=case(match(target_path,"Library/LaunchAgents/com\.apple\.finder\.agent\.plist$"),"fake_finder_launchagent", match(target_path,"Library/LaunchAgents/com\.apple\.[0-9a-f]{8}\.hcpi\.plist$"),"hcpi_launchagent", match(target_path,"Library/Application Support/System"),"backdoor_home_dir", match(target_path,"/\.zshrc$"),"shell_profile_injection", match(target_path,"/\.repair-run$"),"self_repair_script", true(),"other")
| where indicator!="other"
| stats values(indicator) as indicators dc(indicator) as indicator_count values(action) as actions values(target_path) as paths min(_time) as first_seen max(_time) as last_seen by host
| convert ctime(first_seen) ctime(last_seen)
| sort - indicator_count

Microsoft KQL

let lookback = 24h;
DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath has "Library/LaunchAgents"
     or FolderPath has "Library/Application Support/System"
     or FileName in~ (".zshrc", ".bashrc", ".zprofile", ".repair-run")
| extend Indicator = case(
    FileName =~ "com.apple.finder.agent.plist", "fake_finder_launchagent",
    FileName matches regex @"^com\.apple\.[0-9a-f]{8}\.hcpi\.plist$", "hcpi_launchagent",
    FolderPath has "Library/Application Support/System", "backdoor_home_dir",
    FileName =~ ".repair-run", "self_repair_script",
    FileName in~ (".zshrc", ".bashrc", ".zprofile"), "shell_profile_injection",
    "other")
| where Indicator != "other"
| summarize Indicators = make_set(Indicator), IndicatorCount = dcount(Indicator), Paths = make_set(strcat(FolderPath, FileName), 20), Processes = make_set(InitiatingProcessFileName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, AccountName
| order by IndicatorCount desc, FirstSeen desc

Sigma

title: MacSync Backdoor Persistence - Fake Finder LaunchAgent, Backdoor Home Directory and Shell Profile Injection
id: 5d9f2b60-1e47-4c83-a6b2-8f3c7e0d9156
status: experimental
description: Detects the MacSync backdoor persistence footprint - a LaunchAgent masquerading as com.apple.finder.agent, the com.apple.8-hex.hcpi.plist LaunchAgent variant, the non-standard backdoor directory Library/Application Support/System, the .repair-run self-healing script and command injection into shell profiles.
references:
    - https://securelist.com/macsync-new-version/121383/
    - https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering
author: Threadlinqs Team
date: 2026/09/24
tags:
    - attack.persistence
    - attack.t1543.001
    - attack.t1546.004
    - attack.t1546
    - attack.t1036.005
    - attack.tool.macsync
logsource:
    category: file_event
    product: macos
detection:
    selection_launchagent:
        TargetFilename|re: '/Library/LaunchAgents/com\.apple\.(finder\.agent|[0-9a-f]{8}\.hcpi)\.plist$'
    selection_backdoor_dir:
        TargetFilename|contains: '/Library/Application Support/System/'
    selection_repair_script:
        TargetFilename|endswith: '/.repair-run'
    selection_shell_profile:
        TargetFilename|endswith:
            - '/.zshrc'
            - '/.bashrc'
            - '/.zprofile'
    condition: selection_launchagent or selection_backdoor_dir or selection_repair_script or selection_shell_profile
falsepositives:
    - Legitimate installers and MDM packages that create LaunchAgents under the user Library/LaunchAgents directory
    - Dotfile managers such as chezmoi or yadm and shell framework installers legitimately rewriting ~/.zshrc
    - Applications that store support data under Library/Application Support using a generic directory name
level: high

Known false positives:

• Legitimate applications and installers that create LaunchAgents under the user Library/LaunchAgents directory
• Dotfile managers and shell framework installers legitimately rewriting ~/.zshrc or ~/.zprofile
• Software that legitimately stores support data in a generically named Library/Application Support subdirectory

Tuning notes: The com.apple.* namespace under a user's Library/LaunchAgents is the single highest-value indicator here: Apple's own agents live in /System/Library/LaunchAgents and /Library/LaunchAgents, never in a user profile, so consider a strict sub-rule that alerts on any com.apple.* plist written to a user LaunchAgents directory regardless of the rest of the chain. Baseline which applications in your fleet legitimately write LaunchAgents and allowlist those by signer and parent process. Audit git global hooks separately: check core.hooksPath and ~/.git-templates/hooks for the .repair-run re-pull command, because the hook restores the backdoor after file-based remediation and will otherwise silently re-infect a cleaned host.

• 🔒 MacSync Stage-One Loader - Disk Image Delivery, Mounted-Volume App Execution and Piped Shell (zsh -s) · unlock with TL Creds
• 🔒 MacSync Infostealer - Keychain Partition List Rewrite, PAM Password Prompt and Developer Secret Harvesting · unlock with TL Creds
• 🔒 MacSync Stage-Two Delivery via Published iCloud CalDAV Calendar Attachment (Dead Drop) · unlock with TL Creds
• 🔒 MacSync / AMOS-Style JXA Loader - osascript Spawning Shell Utilities (curl, dscl, killall, security) · unlock with TL Creds
• 🔒 MacSync Anti-Analysis - Hypervisor and CPU Brand Checks with ptrace PT_DENY_ATTACH and Encrypted /tmp Staging · unlock with TL Creds
• 🔒 MacSync Backdoor Wallet Trojan - In-Place Rewrite of Ledger Live or Trezor Suite and Out-of-Store Browser Extension Install · unlock with TL Creds
• 🔒 MacSync Stage-One Gatekeeper Bypass - Quarantine Strip, Ad-Hoc Codesign and Launch from Mounted DMG · unlock with TL Creds
• 🔒 MacSync HTTP C2 - Agent Ping Beacon, Chunked Asset Exfiltration and Static api-key Header · unlock with TL Creds

Indicators of compromise

As of 2026-09-24, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-2637.

Sample indicators (3 of 28)

• IP address: 85.206.161[.]241
• Domain: toria[.]app
• URL: hxxp://caldav[.]icloud[.]com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

Technical analysis

It installs a Swift infostealer that verifies the admin password through the PAM API and a persistent Objective-C backdoor masquerading as a Finder LaunchAgent, whose HTTP C2 supports browser-extension deployment, Ledger wallet replacement and live browser relay.

MacSync is a macOS cryptocurrency and information stealer sold under the malware-as-a-service (MaaS) model, first advertised on dark-web forums in 2025 as 'Mac.c' and rebranded to MacSync around September 2025. Early builds were AppleScript droppers closely resembling the AMOS (Atomic macOS Stealer) family; the family has since added a full remote-access backdoor alongside the stealer. In September 2026 Kaspersky (Securelist, Sergey Puzan) documented a substantially reworked version, first observed in the wild that month, whose infection chain has grown to six stages and whose second stage is, in at least one variant, hosted on Apple's own iCloud CalDAV infrastructure rather than attacker-controlled infrastructure.

Delivery is operator-dependent, consistent with MaaS. Observed lures are malicious DMG disk images disguised as free or cracked versions of popular applications and as new software, including the entirely fictitious 'Toria' crypto-wallet application promoted through a dedicated website and on X and Telegram. Two delivery variants were observed within a single fake-app campaign: one where a compiled JXA (JavaScript for Automation) script inside the DMG decodes a shell script and passes it straight to the interpreter without ever writing it to disk, and one that traverses a longer chain of droppers and loaders.

In the longer chain, a stage-one .APP on the disk image strips the com.apple.quarantine attribute with 'xattr -cr', reads an XOR-encrypted URL from its Mach-O overlay (XOR key 73 6f 6e 6f 6d 61 62 6c 64 07, magic SONOMAC1, read backwards as magic, then 8-byte length, then ciphertext), and downloads a second-stage script. In the iCloud variant that URL is a published iCloud calendar: the downloader creates an anonymous pipe, launches 'zsh -s' with the pipe as stdin, and feeds the calendar lines in - the lines are invalid commands until the payload following the DESCRIPTION: line, which downloads a .TAR.GZ from an iCloud CalDAV attachment containing an .APP bundle. That app is stripped of extended attributes, ad-hoc signed and executed. Stage three drops a zlib-compressed, AES-CBC-encrypted executable at /tmp/.sys-<16-digit random value>; stage four adds anti-debugging (VM checks via sysctl on kern.hv_vmm_present and machdep.cpu.brand_string, and ptrace with PT_DENY_ATTACH) and runs an AES-CBC-encrypted shell script; stage five fetches the next stage from the C2, decrypts it with AES-CBC and executes it in memory; stage six downloads the infostealer, the backdoor and the pkgunpack utility, sets persistence and uploads stolen data, with modules arriving as .TAR.GZ that are extracted, stripped of extended attributes and ad-hoc signed.

The infostealer is a Swift binary that impersonates the application the user believed they were installing, prompts for the macOS administrator password, and verifies it through the PAM API rather than the dscl utility - a comparatively new technique in macOS malware. It harvests browser history, cookies, crypto-wallet extension data, saved logins and Local State files, crypto-wallet application data, Telegram data, the device login and password, the Keychain, installed applications, running processes, hardware and UUID details, and SSH/ZSH/AWS/Kubernetes/GIT configuration files, along with ZSH and Bash command history and the current user profile picture. Keychain partition_id lists are rewritten via 'security set-generic-password-partition-list' so that entries are readable by apple:, apple-tool: and specific team IDs (for example EQHXZ8M8AV for Chrome Safe Storage and KL8N8XSYF4 for Brave Safe Storage) without a user confirmation prompt.

The Objective-C backdoor masquerades as the Finder application, lives under $HOME/Library/Application Support/System (not a default macOS directory), logs to $HOME/Library/Logs/.sysnotif-agent.log, and persists as the LaunchAgent com.apple.finder.agent, additionally adding itself as a Login Item and injecting a command into .ZSHRC. A .repair-run script invoked from .ZSHRC and from global GIT pre-commit and post-checkout hooks restores missing backdoor files from backup and recreates and reloads the LaunchAgent. Its HTTP C2 exposes deploy_ext (browser-extension deployment), deploy_ledger (replacement of the Ledger wallet application), regrab (re-collection of system information and specific files) and live_browser (a relay/MitM on victim browser traffic, the only command that is not an AppleScript); all other commands execute a base64 AppleScript supplied by the server's script_b64 field. Beaconing uses GET /v1/agent/ping with tag (victim ID plus build number) and build, where a 403 means an expired token, refreshed via POST /v1/agent/refresh; stolen data is uploaded with POST /v1/asset/<upload_id>/init (size in X-File-Size, SHA-256 in X-File-Sha256) followed by PUT /v1/asset/<upload_id> in 90-megabyte chunks, all gated by a custom X-Upload-Token header. Data keys are wrapped with ECDH over Curve25519 (curve25519_donna) and AES-GCM, with buffers zeroed after use at each stage to hinder forensics and dynamic analysis.

Attribution: Kaspersky presents MacSync as a MaaS product and does not name an operator. Independent reporting on the SONOMAC1/'Sonoma' cluster - which shares the same campaign apex domains (appstore.com.mx, apple03cloudstore.com), the same iCloud CalDAV staging technique, the same /tmp/osalogging.zip staging artefact and the same pkgunpack/Curve25519/AES-GCM tooling - attributes that operation to the 'Crazy Evil' traffer team (named sub-teams DEFI, ZOOMLAND, AVLAND, KEVLAND), whose tooling previously delivered AMOS-style stealers behind fake Loom downloads. Attribution is assessed at MEDIUM confidence: the infrastructure overlap is strong and independently reported, but no vendor has formally merged the two family names, and MacSync is explicitly distinct from PamStealer/'Avenger' (Jamf, July 2026), another macOS stealer that also abuses the PAM API - 'PAM' describes an API, not a family.

Detection relevance: the family's durable, rotation-resistant signals are behavioural rather than domain-based - curl fetching /curl/<token> or /dynamic?txd=, exfiltration via PUT to /gate?buildtxd= with upload_id/chunk_index/total_chunks parameters and an api-key header, osascript executing shell utilities (sh, cp, rm, curl, mkdir, killall, dscl), xattr -cr followed by ad-hoc codesign and open -gn, staging under /tmp/.sys-*, /tmp/.ldr-*, /tmp/.pkgunpack-*, /tmp/.core-*.enc and /tmp/osalogging.zip, and any outbound request to *.icloud.com/caldav/.../attach/ piped into tar. Microsoft documented that correlating these traits connected more than 30 rotating domains, and RST Cloud showed a static api-key value binding four confirmed C2 domains across separate deployments while the per-build token rotated. BeaconBeagle returned no C2-framework configuration match for the network indicators checked (85.206.161.241, 103.216.221.95, agenticsora.com, toria.apple03cloudstore.com, docsend.appstore.com.mx), consistent with a bespoke HTTP C2 rather than a commodity framework such as Cobalt Strike or Sliver.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1056.002 Input Capture: GUI Input Capture; T1074.001 Data Staged: Local Data Staging; T1560.001 Archive Collected Data: Archive via Utility

Defense Evasion

T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1622 Debugger Evasion

Execution

T1059.002 Command and Scripting Interpreter: AppleScript; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.007 Command and Scripting Interpreter: JavaScript; T1106 Native API; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Persistence

T1543.001 Create or Modify System Process: Launch Agent; T1546 Event Triggered Execution; T1546.004 Event Triggered Execution: Unix Shell Configuration Modification; T1554 Compromise Host Software Binary

defense-impairment

T1553.001 Subvert Trust Controls: Gatekeeper Bypass; T1553.002 Subvert Trust Controls: Code Signing

Remediation

Patches

• No CVE or vendor patch applies - MacSync is MaaS malware, not a software vulnerability. Apply current Apple security updates and keep Gatekeeper and XProtect enabled; macOS 26.4+ additionally blocks the ClickFix paste vector.

Immediate actions

• Treat any curl|zsh, '/bin/zsh -s' pipe, or osascript execution initiated from Terminal as a potential compromise; isolate and triage the host rather than just deleting files.
• Hunt for and remove the staging artefacts /tmp/.sys-*, /tmp/.ldr-*, /tmp/.pkgunpack-*, /tmp/.eph-*.key, /tmp/.core-*.enc, /tmp/.core-*.tar.gz, /tmp/sync*/ and /tmp/osalogging.zip.
• Remove the LaunchAgent com.apple.finder.agent and any ~/Library/LaunchAgents/com.apple.<8hex>.hcpi.plist entry, the Login Item, the injected .ZSHRC lines and the .repair-run script, and audit global git pre-commit and post-checkout hooks.
• Block or alert on outbound requests to the campaign apexes appstore.com.mx and apple03cloudstore.com and to the confirmed C2 hosts docsend.appstore.com.mx, toria.apple03cloudstore.com, streamyard.appstore.com.mx, slack.apple03cloudstore.com and waaako.appstore.com.mx.
• Assume full credential compromise: rotate the macOS account password, all browser-saved credentials and session cookies, SSH keys, AWS and Kubernetes credentials, and move funds and seed phrases off any wallet present on the host (Ledger, Trezor, MetaMask and browser-extension wallets).

Workarounds

• Disable or centrally manage global git hooks and audit .zshrc/.bashrc for injected re-pull commands that re-stage the backdoor.
• Block execution from /tmp and /Volumes for non-admin users via MDM policy.
• Monitor via the Endpoint Security framework for PAM API credential verification, ptrace(PT_DENY_ATTACH) and sysctl kern.hv_vmm_present probes as anti-analysis and credential-phishing signals.

Longer-term hardening

• Deploy EDR with behavioural coverage for osascript-abused shell utilities, curl PUT exfiltration with upload_id/chunk_index/total_chunks parameters, and LaunchAgent creation outside signed installers.
• Enforce macOS 26.4 or later where possible: it blocks pasted Terminal commands with a 'Possible malware, Paste blocked' warning and adds XProtect script checks, mitigating the ClickFix delivery vector.
• Require Developer ID signing and notarisation via MDM and restrict standard users from launching unsigned or ad-hoc-signed applications from /tmp and /Volumes.
• Monitor DNS and certificate transparency for lookalike domains registered against brand keywords and for newly issued Let's Encrypt certificates on campaign-shaped hostnames, which rotate roughly 24 hours after public disclosure.
• Treat developer and crypto-treasury workstations as high-value assets and monitor for anomalous access to Keychain, browser Safe Storage and dotfile credential stores.

Affected and fixed versions

• Apple — macOS
  Vulnerable versions: All supported releases are targeted (macOS 13 Ventura through macOS 26.x)
  Fixed in: No fix applies - this is malware, not a vulnerability. macOS 26.4 and later add ClickFix paste-blocking and XProtect script checks that mitigate the delivery vector only.
• Ledger — Ledger Live / Ledger Wallet desktop
  Vulnerable versions: Application replaced in place by the backdoor's deploy_ledger command; observed versions 2.133.0 and 2.126.2
• Trezor — Trezor Suite desktop
  Vulnerable versions: Application replaced in place by the wallet-trojan module, which also allowlists main.southcarolinacounselor.com in the app's network configuration

Timeline

• 2025-09-01 MacSync is rebranded from its original 'Mac.c' dark-web listing and continues to be sold under a malware-as-a-service model (Securelist; RST Cloud).
• 2025-12-16 CloudSEK publishes YARA rules for MacSync, the earliest public detection content for the family (RST Cloud timeline).
• 2026-05-01 SANS Internet Storm Center publicly discloses the then-current MacSync C2 glowmedaesthetics.com (RST Cloud).
• 2026-05-05 Jamf Protect blocks a MacSync stage-one download from jacksonvillemma.com; the new C2's Let's Encrypt certificate had been issued on 2 May 2026, roughly 24 hours after the prior C2 was disclosed (RST Cloud).
• 2026-05-08 RST Cloud publishes 'MacSync Stealer: C2 Infrastructure Rotation', showing a static api-key value binding four confirmed C2 domains while the per-build token rotates (RST Cloud).
• 2026-07-15 Huntress observes a mid-July intrusion delivering a six-stage MacSync chain from locked-ioc-19 via a poisoned claude.ai share page and Google Ads malvertising (Huntress).
• 2026-07-29 Huntress publishes its reverse-engineering analysis of the six-stage MacSync stealer and RAT, including the Mach-O agent, capture agent and Ledger/Trezor wallet trojans (Huntress).
• 2026-08-18 Microsoft Security publishes behavioural-pivot hunting research that correlates more than 30 rotating MacSync domains via shared URI paths, headers and curl command-line traits (Microsoft Security).
• 2026-09-14 Researcher @L0Psec publishes a thread on the locked-ioc-28 chain, initially hypothesised to be PamStealer before it was distinguished from that family (HackerNoon).
• 2026-09-21 Moonlock/HackerNoon document the SONOMAC1 'Sonoma' cluster and attribute the operation to the Crazy Evil traffer team (HackerNoon).
• 2026-09-24 Kaspersky publishes 'MacSync: a new version of the macOS stealer', documenting the reworked six-stage chain, iCloud CalDAV stage-two staging and the newly added backdoor (Securelist).

Sources cited

• MacSync: a new version of the macOS stealer (Securelist, Sergey Puzan) Kaspersky Securelist · Vendor report · 2026-09-24
• Reverse Engineering the Six Stages of MacSync Stealer and RAT (Huntress) Huntress · Research · 2026-07-29
• Hunting MacSync Stealer infrastructure through behavioral pivots (Microsoft Security) Microsoft · Vendor report · 2026-08-18
• MacSync Stealer: C2 Infrastructure Rotation (RST Cloud) rstcloud.com · Research · 2026-05-08
• Downloading Zoom or Brave? Could Be New Mac Malware 'Sonoma' In Disguise (HackerNoon, on Moonlock reporting) hackernoon.com · News · 2026-09-21

Related threats

• Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
• Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
• MacSync Stealer: Malvertising Campaign Impersonates Claude/Apple Support to Deploy macOS Infostealer
• Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate
• Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign

Previous and next in malware

• Autonomous AI Agent Operation (Strix, Cairn, Hermes) Steals 600K+ Payment Cards and Injects Skimmers into 100+ E-Commerce Sites Previous report
• Carbonato botnet: AI-agent-driven worm hijacks unauthenticated Docker daemons on port 2375 and installs the Hermes Agent 'GH0ST' implant Next report