# MacSync macOS infostealer/backdoor: reworked MaaS chain stages stage-two via a public iCloud calendar (SONOMAC1)

> Kaspersky documented a substantially reworked version of MacSync, a macOS crypto/infostealer plus backdoor sold malware-as-a-service, first seen in the wild in September 2026. The six-stage chain delivers a compiled JXA loader disguised as cracked apps or the fictitious 'Toria' crypto-wallet app and, in at least one variant, stages stage-two from a publicly published iCloud CalDAV calendar entry hosting Loader.app.tar.gz. It installs a Swift infostealer that verifies the admin password through the PAM API and a persistent Objective-C backdoor masquerading as a Finder LaunchAgent, whose HTTP C2 supports browser-extension deployment, Ledger wallet replacement and live browser relay.

- **Published:** 2026-09-24T00:00:00Z
- **Last reviewed:** 2026-09-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2637
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-macsync-sonomac1-maas-variant-tl-2026-2637.webp?v=f777f3f9 (Threadlinqs threat intel: MacSync SONOMAC1 Variant: Detection & IOCs (TL-2026-2637) — High severity, 28 IOCs, 9 detection rules.)
- **ID:** TL-2026-2637
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Crazy Evil
- **Detections:** 9 (1 shown free below) · **IOCs:** 28 (3 shown free below)

## Description

MacSync is a macOS cryptocurrency and information stealer sold under the malware-as-a-service (MaaS) model, first advertised on dark-web forums in 2025 as 'Mac.c' and rebranded to MacSync around September 2025. Early builds were AppleScript droppers closely resembling the AMOS (Atomic macOS Stealer) family; the family has since added a full remote-access backdoor alongside the stealer. In September 2026 Kaspersky (Securelist, Sergey Puzan) documented a substantially reworked version, first observed in the wild that month, whose infection chain has grown to six stages and whose second stage is, in at least one variant, hosted on Apple's own iCloud CalDAV infrastructure rather than attacker-controlled infrastructure.

Delivery is operator-dependent, consistent with MaaS. Observed lures are malicious DMG disk images disguised as free or cracked versions of popular applications and as new software, including the entirely fictitious 'Toria' crypto-wallet application promoted through a dedicated website and on X and Telegram. Two delivery variants were observed within a single fake-app campaign: one where a compiled JXA (JavaScript for Automation) script inside the DMG decodes a shell script and passes it straight to the interpreter without ever writing it to disk, and one that traverses a longer chain of droppers and loaders.

In the longer chain, a stage-one .APP on the disk image strips the com.apple.quarantine attribute with 'xattr -cr', reads an XOR-encrypted URL from its Mach-O overlay (XOR key 73 6f 6e 6f 6d 61 62 6c 64 07, magic SONOMAC1, read backwards as magic, then 8-byte length, then ciphertext), and downloads a second-stage script. In the iCloud variant that URL is a published iCloud calendar: the downloader creates an anonymous pipe, launches 'zsh -s' with the pipe as stdin, and feeds the calendar lines in - the lines are invalid commands until the payload following the DESCRIPTION: line, which downloads a .TAR.GZ from an iCloud CalDAV attachment containing an .APP bundle. That app is stripped of extended attributes, ad-hoc signed and executed. Stage three drops a zlib-compressed, AES-CBC-encrypted executable at /tmp/.sys-<16-digit random value>; stage four adds anti-debugging (VM checks via sysctl on kern.hv_vmm_present and machdep.cpu.brand_string, and ptrace with PT_DENY_ATTACH) and runs an AES-CBC-encrypted shell script; stage five fetches the next stage from the C2, decrypts it with AES-CBC and executes it in memory; stage six downloads the infostealer, the backdoor and the pkgunpack utility, sets persistence and uploads stolen data, with modules arriving as .TAR.GZ that are extracted, stripped of extended attributes and ad-hoc signed.

The infostealer is a Swift binary that impersonates the application the user believed they were installing, prompts for the macOS administrator password, and verifies it through the PAM API rather than the dscl utility - a comparatively new technique in macOS malware. It harvests browser history, cookies, crypto-wallet extension data, saved logins and Local State files, crypto-wallet application data, Telegram data, the device login and password, the Keychain, installed applications, running processes, hardware and UUID details, and SSH/ZSH/AWS/Kubernetes/GIT configuration files, along with ZSH and Bash command history and the current user profile picture. Keychain partition_id lists are rewritten via 'security set-generic-password-partition-list' so that entries are readable by apple:, apple-tool: and specific team IDs (for example EQHXZ8M8AV for Chrome Safe Storage and KL8N8XSYF4 for Brave Safe Storage) without a user confirmation prompt.

The Objective-C backdoor masquerades as the Finder application, lives under $HOME/Library/Application Support/System (not a default macOS directory), logs to $HOME/Library/Logs/.sysnotif-agent.log, and persists as the LaunchAgent com.apple.finder.agent, additionally adding itself as a Login Item and injecting a command into .ZSHRC. A .repair-run script invoked from .ZSHRC and from global GIT pre-commit and post-checkout hooks restores missing backdoor files from backup and recreates and reloads the LaunchAgent. Its HTTP C2 exposes deploy_ext (browser-extension deployment), deploy_ledger (replacement of the Ledger wallet application), regrab (re-collection of system information and specific files) and live_browser (a relay/MitM on victim browser traffic, the only command that is not an AppleScript); all other commands execute a base64 AppleScript supplied by the server's script_b64 field. Beaconing uses GET /v1/agent/ping with tag (victim ID plus build number) and build, where a 403 means an expired token, refreshed via POST /v1/agent/refresh; stolen data is uploaded with POST /v1/asset/<upload_id>/init (size in X-File-Size, SHA-256 in X-File-Sha256) followed by PUT /v1/asset/<upload_id> in 90-megabyte chunks, all gated by a custom X-Upload-Token header. Data keys are wrapped with ECDH over Curve25519 (curve25519_donna) and AES-GCM, with buffers zeroed after use at each stage to hinder forensics and dynamic analysis.

Attribution: Kaspersky presents MacSync as a MaaS product and does not name an operator. Independent reporting on the SONOMAC1/'Sonoma' cluster - which shares the same campaign apex domains (appstore.com.mx, apple03cloudstore.com), the same iCloud CalDAV staging technique, the same /tmp/osalogging.zip staging artefact and the same pkgunpack/Curve25519/AES-GCM tooling - attributes that operation to the 'Crazy Evil' traffer team (named sub-teams DEFI, ZOOMLAND, AVLAND, KEVLAND), whose tooling previously delivered AMOS-style stealers behind fake Loom downloads. Attribution is assessed at MEDIUM confidence: the infrastructure overlap is strong and independently reported, but no vendor has formally merged the two family names, and MacSync is explicitly distinct from PamStealer/'Avenger' (Jamf, July 2026), another macOS stealer that also abuses the PAM API - 'PAM' describes an API, not a family.

Detection relevance: the family's durable, rotation-resistant signals are behavioural rather than domain-based - curl fetching /curl/<token> or /dynamic?txd=, exfiltration via PUT to /gate?buildtxd= with upload_id/chunk_index/total_chunks parameters and an api-key header, osascript executing shell utilities (sh, cp, rm, curl, mkdir, killall, dscl), xattr -cr followed by ad-hoc codesign and open -gn, staging under /tmp/.sys-*, /tmp/.ldr-*, /tmp/.pkgunpack-*, /tmp/.core-*.enc and /tmp/osalogging.zip, and any outbound request to *.icloud.com/caldav/.../attach/ piped into tar. Microsoft documented that correlating these traits connected more than 30 rotating domains, and RST Cloud showed a static api-key value binding four confirmed C2 domains across separate deployments while the per-build token rotated. BeaconBeagle returned no C2-framework configuration match for the network indicators checked (85.206.161.241, 103.216.221.95, agenticsora.com, toria.apple03cloudstore.com, docsend.appstore.com.mx), consistent with a bespoke HTTP C2 rather than a commodity framework such as Cobalt Strike or Sliver.

## MITRE ATT&CK

- T1204.002 User Execution: Malicious File
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.002 Command and Scripting Interpreter: AppleScript
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1106 Native API
- T1543.001 Create or Modify System Process: Launch Agent
- T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
- T1546 Event Triggered Execution
- T1554 Compromise Host Software Binary
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1553.001 Subvert Trust Controls: Gatekeeper Bypass
- T1553.002 Subvert Trust Controls: Code Signing
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1622 Debugger Evasion
- T1555.001 Credentials from Password Stores: Keychain
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1056.002 Input Capture: GUI Input Capture
- T1005 Data from Local System
- T1074.001 Data Staged: Local Data Staging
- T1560.001 Archive Collected Data: Archive via Utility
- T1071.001 Application Layer Protocol: Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**MacSync Backdoor Persistence - Fake Finder LaunchAgent, Backdoor Home Directory and Shell Profile Injection** (`TL-2026-2637-SPL-002`)

Detects the MacSync backdoor persistence footprint. The Objective-C backdoor masquerades as the Finder application, persists as the LaunchAgent com.apple.finder.agent and in related builds as ~/Library/LaunchAgents/com.apple.<8 hex>.hcpi.plist, keeps its payload in $HOME/Library/Application Support/System, deliberately not a default macOS location, and re-establishes itself by injecting commands into .ZSHRC plus a .repair-run script that is also invoked from global git pre-commit and post-checkout hooks. These are file-system artefacts, so they are detectable without any network visibility and survive C2 rotation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1543.001, T1546.004, T1546, T1036.005, T1074.001
- **Data sources:** macos:osquery (file_events, launchd), DeviceFileEvents (Defender for Endpoint on macOS), macos:unifiedlog (subsystem com.apple.launchservices)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=macos sourcetype="macos:osquery" (file_events OR launchd)
| search ("Library/LaunchAgents" AND ".plist") OR "Application Support/System" OR ".zshrc" OR ".repair-run" OR ".hcpi"
| eval indicator=case(match(target_path,"Library/LaunchAgents/com\.apple\.finder\.agent\.plist$"),"fake_finder_launchagent", match(target_path,"Library/LaunchAgents/com\.apple\.[0-9a-f]{8}\.hcpi\.plist$"),"hcpi_launchagent", match(target_path,"Library/Application Support/System"),"backdoor_home_dir", match(target_path,"/\.zshrc$"),"shell_profile_injection", match(target_path,"/\.repair-run$"),"self_repair_script", true(),"other")
| where indicator!="other"
| stats values(indicator) as indicators dc(indicator) as indicator_count values(action) as actions values(target_path) as paths min(_time) as first_seen max(_time) as last_seen by host
| convert ctime(first_seen) ctime(last_seen)
| sort - indicator_count
```

### Microsoft KQL

```kql
let lookback = 24h;
DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath has "Library/LaunchAgents"
     or FolderPath has "Library/Application Support/System"
     or FileName in~ (".zshrc", ".bashrc", ".zprofile", ".repair-run")
| extend Indicator = case(
    FileName =~ "com.apple.finder.agent.plist", "fake_finder_launchagent",
    FileName matches regex @"^com\.apple\.[0-9a-f]{8}\.hcpi\.plist$", "hcpi_launchagent",
    FolderPath has "Library/Application Support/System", "backdoor_home_dir",
    FileName =~ ".repair-run", "self_repair_script",
    FileName in~ (".zshrc", ".bashrc", ".zprofile"), "shell_profile_injection",
    "other")
| where Indicator != "other"
| summarize Indicators = make_set(Indicator), IndicatorCount = dcount(Indicator), Paths = make_set(strcat(FolderPath, FileName), 20), Processes = make_set(InitiatingProcessFileName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, AccountName
| order by IndicatorCount desc, FirstSeen desc
```

### Sigma

```yaml
title: MacSync Backdoor Persistence - Fake Finder LaunchAgent, Backdoor Home Directory and Shell Profile Injection
id: 5d9f2b60-1e47-4c83-a6b2-8f3c7e0d9156
status: experimental
description: Detects the MacSync backdoor persistence footprint - a LaunchAgent masquerading as com.apple.finder.agent, the com.apple.8-hex.hcpi.plist LaunchAgent variant, the non-standard backdoor directory Library/Application Support/System, the .repair-run self-healing script and command injection into shell profiles.
references:
    - https://securelist.com/macsync-new-version/121383/
    - https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering
author: Threadlinqs Team
date: 2026/09/24
tags:
    - attack.persistence
    - attack.t1543.001
    - attack.t1546.004
    - attack.t1546
    - attack.t1036.005
    - attack.tool.macsync
logsource:
    category: file_event
    product: macos
detection:
    selection_launchagent:
        TargetFilename|re: '/Library/LaunchAgents/com\.apple\.(finder\.agent|[0-9a-f]{8}\.hcpi)\.plist$'
    selection_backdoor_dir:
        TargetFilename|contains: '/Library/Application Support/System/'
    selection_repair_script:
        TargetFilename|endswith: '/.repair-run'
    selection_shell_profile:
        TargetFilename|endswith:
            - '/.zshrc'
            - '/.bashrc'
            - '/.zprofile'
    condition: selection_launchagent or selection_backdoor_dir or selection_repair_script or selection_shell_profile
falsepositives:
    - Legitimate installers and MDM packages that create LaunchAgents under the user Library/LaunchAgents directory
    - Dotfile managers such as chezmoi or yadm and shell framework installers legitimately rewriting ~/.zshrc
    - Applications that store support data under Library/Application Support using a generic directory name
level: high
```

**Known false positives:**

- Legitimate applications and installers that create LaunchAgents under the user Library/LaunchAgents directory
- Dotfile managers and shell framework installers legitimately rewriting ~/.zshrc or ~/.zprofile
- Software that legitimately stores support data in a generically named Library/Application Support subdirectory

**Tuning notes:** The com.apple.* namespace under a user's Library/LaunchAgents is the single highest-value indicator here: Apple's own agents live in /System/Library/LaunchAgents and /Library/LaunchAgents, never in a user profile, so consider a strict sub-rule that alerts on any com.apple.* plist written to a user LaunchAgents directory regardless of the rest of the chain. Baseline which applications in your fleet legitimately write LaunchAgents and allowlist those by signer and parent process. Audit git global hooks separately: check core.hooksPath and ~/.git-templates/hooks for the .repair-run re-pull command, because the hook restores the backdoor after file-based remediation and will otherwise silently re-infect a cleaned host.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MacSync Stage-One Loader - Disk Image Delivery, Mounted-Volume App Execution and Piped Shell (zsh -s) (locked: unlock with TL Creds)
- MacSync Infostealer - Keychain Partition List Rewrite, PAM Password Prompt and Developer Secret Harvesting (locked: unlock with TL Creds)
- MacSync Stage-Two Delivery via Published iCloud CalDAV Calendar Attachment (Dead Drop) (locked: unlock with TL Creds)
- MacSync / AMOS-Style JXA Loader - osascript Spawning Shell Utilities (curl, dscl, killall, security) (locked: unlock with TL Creds)
- MacSync Anti-Analysis - Hypervisor and CPU Brand Checks with ptrace PT_DENY_ATTACH and Encrypted /tmp Staging (locked: unlock with TL Creds)
- MacSync Backdoor Wallet Trojan - In-Place Rewrite of Ledger Live or Trezor Suite and Out-of-Store Browser Extension Install (locked: unlock with TL Creds)
- MacSync Stage-One Gatekeeper Bypass - Quarantine Strip, Ad-Hoc Codesign and Launch from Mounted DMG (locked: unlock with TL Creds)
- MacSync HTTP C2 - Agent Ping Beacon, Chunked Asset Exfiltration and Static api-key Header (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 28)

Defanged, TLP:CLEAR.

- IP address: `85.206.161[.]241`
- Domain: `toria[.]app`
- URL: `hxxp://caldav[.]icloud[.]com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08`

Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [MacSync: a new version of the macOS stealer (Securelist, Sergey Puzan)](https://securelist.com/macsync-new-version/121383/)
- [Reverse Engineering the Six Stages of MacSync Stealer and RAT (Huntress)](https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering)
- [Hunting MacSync Stealer infrastructure through behavioral pivots (Microsoft Security)](https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/)
- [MacSync Stealer: C2 Infrastructure Rotation (RST Cloud)](https://www.rstcloud.com/macsync-stealer-c2-infrastructure-rotation/)
- [Downloading Zoom or Brave? Could Be New Mac Malware 'Sonoma' In Disguise (HackerNoon, on Moonlock reporting)](https://hackernoon.com/downloading-zoom-or-brave-could-be-new-mac-malware-sonoma-in-disguise)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2637