MacSync is a Swift-based macOS infostealer distributed as malware-as-a-service. It first emerged in April 2025 as part of the AMOS (Atomic macOS Stealer) lineage; Kaspersky tracks it as Trojan.OSX.MacSync and notes it was initially advertised on the dark web as 'Mac.c' before being renamed MacSync. In September 2026 Kaspersky observed a substantially more advanced version with binary payloads and a new backdoor module, delivered via new infection chains targeting developers and cryptocurrency users.

DELIVERY. Infection begins from DMG images distributed as fake or cracked applications, a nonexistent crypto wallet called 'Toria' promoted on X and Telegram (toria.app), and ClickFix-style social engineering campaigns disguising the malware as Homebrew and macOS disk-space analyzer tools. The DMG contains an .APP bundle that removes the com.apple.quarantine attribute (xattr -cr) and extracts an XOR-encrypted URL from its overlay (key bytes 'sonomabld'; overlay read backwards with magic word SONOMAC1) that fetches the next-stage downloader.

NOVEL ICLOUD CALENDAR COMMAND CHANNEL. In one variant the downloader fetches commands hidden in the description of a public iCloud calendar event (.ics format hosted on caldav.icloud.com). It launches zsh -s reading stdin from a pipe and feeds the calendar contents line by line; most text produces shell errors, but commands placed after the DESCRIPTION: line execute and download a .TAR.GZ archive from iCloud (gateway.icloud.com) containing an .APP dropper. The operator abuses Apple's own infrastructure rather than attacker-controlled domains, making the channel low-cost and hard to block. The archive is stripped of quarantine and extended attributes, ad-hoc code signed, and executed.

MULTI-STAGE DECRYPTION CHAIN. Payloads are delivered through layered obfuscation: zlib-compressed executables wrapped in AES-CBC, then AES-GCM, using a custom 'pkgunpack' utility implementing ECDH key exchange on Curve25519 (open-source curve25519_donna) to derive per-payload keys. Modules are decrypted to /tmp/.sys-<16-digit> paths, and pkgunpack zeroes key buffers after each stage to impede forensics and dynamic analysis. A custom X-Upload-Token HTTP header is required for C2 communications.

INFOSTEALER. The Swift stealer requests the admin password through a window impersonating the targeted app and verifies it using the PAM API (a technique first seen in the July 2026 'Pam Stealer' family) rather than dscl, then displays a fake 'app is damaged - move to Trash' dialog as a distraction. It collects browser history, cookies, saved credentials and crypto-wallet-extension data, crypto wallet application data, Telegram data, the Keychain file, device login/password, system information (installed apps, processes, model, UUID), and SSH, ZSH, AWS, Kubernetes and Git configuration files plus shell command history. Data is packaged into a .tar.gz and uploaded to the C2 server via PUT requests in 90-megabyte chunks.

NEW BACKDOOR MODULE. A new Objective-C backdoor (fat Mach-O, Apple Silicon + Intel) masquerades as Finder, the default macOS file manager. Its config is stored XOR-encrypted in the binary overlay (magic constant AGNT1, C2 URL, access token, build BLD-150). It communicates over HTTP with endpoints /v1/agent/ping, /v1/agent/refresh and /v1/asset/<id>. C2 commands execute attacker-supplied AppleScript and include deploy_ext (deploy a browser extension), deploy_ledger (replace the installed Ledger wallet with a C2-supplied clone), regrab (re-collect and exfiltrate system info/files packaged to /tmp/osalogging.zip), and the mystery command live_browser, which downloads and runs a component named sn_relay that Kaspersky suspects enables man-in-the-middle interception of the victim's browser traffic. Persistence is established via a LaunchAgent named com.apple.finder.agent, injection into .zshrc running a .repair-run script at every shell startup, and injection of the same script into global Git pre-commit and post-checkout hooks; on macOS older than 13.0 a helper registers the backdoor as a Login Item. The malware terminates notification processes (BTMNotificationAgent, NotificationCenter, BackgroundTaskManagementAgent) to hide the new LaunchAgent from the user.

ANTI-ANALYSIS. The malware employs ptrace with the PT_DENY_ATTACH flag for debugger evasion, sysctl checks of kern.hv_vmm_present and machdep.cpu.brand_string for VM detection, quarantine removal and extended-attribute stripping, ad-hoc code signing of downloaded bundles, deletion of temp files and logs after execution, /tmp/*.lock files to prevent re-execution, and buffer zeroing in the decryption utility.

DEFENSE. Mitigations include not executing commands found online, avoiding DMG downloads from suspicious or promotional sources, treating admin password prompts with caution, and monitoring for the com.apple.finder.agent LaunchAgent and .repair-run persistence artifacts.