MacSync macOS infostealer abuses public iCloud calendars as a command channel to deliver a new backdoor module

Key facts

Detection coverage

As of 2026-09-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2641 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MacSync iCloud Calendar Command Channel — zsh Executing Fetched Commands

Detects the novel command-and-delivery channel used by the MacSync downloader: a Unix shell (zsh/bash) is launched reading stdin from a pipe and fed the contents of a public iCloud calendar event (.ics) fetched from caldav.icloud.com, executing commands placed after the DESCRIPTION: line that download a .tar.gz dropper archive from gateway.icloud.com. This abuses Apple's own infrastructure rather than attacker domains.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1105, T1071.001
• Data sources: osquery, macos_unified_log
• Severity: high
• Confidence: high

Splunk SPL

index=endpoint sourcetype="osquery:results"
  | search (name="zsh" OR name="bash" OR name="sh")
  | regex cmdline="(?i)(caldav\.icloud\.com|gateway\.icloud\.com|DESCRIPTION|\.ics|\.tar\.gz|zsh\s+-s)"
  | search (cmdline="*curl*" OR cmdline="*wget*" OR cmdline="*python3*")
  | table _time host user name cmdline
  | sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("caldav.icloud.com", "gateway.icloud.com", ".tar.gz", ".ics", "zsh -s")
| where ProcessCommandLine has_any ("curl", "wget", "python3", "zsh -s")
| where FileName in~ ("zsh", "bash", "sh", "curl", "wget")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName

Sigma

title: MacSync macOS Infostealer - Suspicious Shell Download and Quarantine Bypass
id: 4f9c2d7a-6b1e-4a3c-9d8e-2f0c1a3b5d71
status: experimental
description: Detects a Unix shell (zsh/bash) reading remote content from a pipe and executing it, downloading archives from iCloud or attacker-controlled hosts, and stripping the quarantine attribute with xattr -cr, consistent with the MacSync macOS infostealer delivery chain.
references:
  - https://securelist.com/macsync-new-version/121383/
  - https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/
author: Threadlinqs Team
date: 2026/09/24
tags:
  - attack.execution
  - attack.t1059.004
  - attack.defense_evasion
  - attack.t1140
  - attack.t1070.004
  - attack.tool.macsync
logsource:
  category: process_creation
  product: macos
detection:
  selection_shell:
    Image|endswith:
      - '/zsh'
      - '/bash'
      - '/sh'
  selection_remote:
    CommandLine|contains|all:
      - 'curl'
    CommandLine|contains:
      - 'caldav.icloud.com'
      - 'gateway.icloud.com'
      - '.tar.gz'
      - '.ics'
  selection_stdin:
    CommandLine|contains:
      - 'zsh -s'
      - 'bash -s'
      - 'python3 -'
  selection_quarantine:
    CommandLine|contains|all:
      - 'xattr'
      - '-cr'
  condition: selection_shell and (selection_remote or selection_stdin or selection_quarantine)
falsepositives:
  - Developers legitimately fetching Homebrew or tool installers hosted on iCloud
  - Scripts that pipe remote content into a shell as part of automated provisioning
level: high

Known false positives:

• Developers scripting legitimate downloads from iCloud/Homebrew
• Automated provisioning scripts that pipe remote content into a shell

Tuning notes: Baseline legitimate iCloud calendar fetches and Homebrew installs; alert when a shell reads stdin (zsh -s) in combination with a .tar.gz download from gateway.icloud.com/caldav.icloud.com. Correlate with a subsequent non-Apple-blessed .app execution.

• 🔒 MacSync Finder-Masquerading Backdoor Process Execution · unlock with TL Creds
• 🔒 MacSync Credential Theft and Data Collection — Keychain, Browser and Config Files · unlock with TL Creds
• 🔒 MacSync Backdoor Remote Command Execution — AppleScript and Defense Impairment · unlock with TL Creds
• 🔒 MacSync Dropper — Ad-hoc Signed Bundle and Quarantine Removal · unlock with TL Creds
• 🔒 MacSync Login Item and Shell/Git Persistence Chain · unlock with TL Creds
• 🔒 MacSync Network C2 and Exfiltration — Abused Apple Infrastructure · unlock with TL Creds
• 🔒 MacSync Persistence — Finder LaunchAgent, .zshrc and Global Git Hook Injection · unlock with TL Creds
• 🔒 MacSync Backdoor C2 — /v1/agent HTTP Beaconing and Chunked Exfiltration · unlock with TL Creds

Indicators of compromise

As of 2026-09-24, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-2641.

Sample indicators (3 of 26)

• Domain: docsend[.]appstore[.]com[.]mx
• File hash: 26a0f7cdb9f7dc5ace9a40af825b1538
• Domain: streamyard[.]appstore[.]com[.]mx

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Technical analysis

The chain stages a dropper that installs the MacSync infostealer plus a new Objective-C backdoor masquerading as Finder, with persistence via LaunchAgent, .zshrc, and global Git hooks, remote AppleScript execution, browser-extension and Ledger-wallet replacement, and system-info exfiltration.

MacSync is a Swift-based macOS infostealer distributed as malware-as-a-service. It first emerged in April 2025 as part of the AMOS (Atomic macOS Stealer) lineage; Kaspersky tracks it as Trojan.OSX.MacSync and notes it was initially advertised on the dark web as 'Mac.c' before being renamed MacSync. In September 2026 Kaspersky observed a substantially more advanced version with binary payloads and a new backdoor module, delivered via new infection chains targeting developers and cryptocurrency users.

DELIVERY. Infection begins from DMG images distributed as fake or cracked applications, a nonexistent crypto wallet called 'Toria' promoted on X and Telegram (toria.app), and ClickFix-style social engineering campaigns disguising the malware as Homebrew and macOS disk-space analyzer tools. The DMG contains an .APP bundle that removes the com.apple.quarantine attribute (xattr -cr) and extracts an XOR-encrypted URL from its overlay (key bytes 'sonomabld'; overlay read backwards with magic word SONOMAC1) that fetches the next-stage downloader.

NOVEL ICLOUD CALENDAR COMMAND CHANNEL. In one variant the downloader fetches commands hidden in the description of a public iCloud calendar event (.ics format hosted on caldav.icloud.com). It launches zsh -s reading stdin from a pipe and feeds the calendar contents line by line; most text produces shell errors, but commands placed after the DESCRIPTION: line execute and download a .TAR.GZ archive from iCloud (gateway.icloud.com) containing an .APP dropper. The operator abuses Apple's own infrastructure rather than attacker-controlled domains, making the channel low-cost and hard to block. The archive is stripped of quarantine and extended attributes, ad-hoc code signed, and executed.

MULTI-STAGE DECRYPTION CHAIN. Payloads are delivered through layered obfuscation: zlib-compressed executables wrapped in AES-CBC, then AES-GCM, using a custom 'pkgunpack' utility implementing ECDH key exchange on Curve25519 (open-source curve25519_donna) to derive per-payload keys. Modules are decrypted to /tmp/.sys-<16-digit> paths, and pkgunpack zeroes key buffers after each stage to impede forensics and dynamic analysis. A custom X-Upload-Token HTTP header is required for C2 communications.

INFOSTEALER. The Swift stealer requests the admin password through a window impersonating the targeted app and verifies it using the PAM API (a technique first seen in the July 2026 'Pam Stealer' family) rather than dscl, then displays a fake 'app is damaged - move to Trash' dialog as a distraction. It collects browser history, cookies, saved credentials and crypto-wallet-extension data, crypto wallet application data, Telegram data, the Keychain file, device login/password, system information (installed apps, processes, model, UUID), and SSH, ZSH, AWS, Kubernetes and Git configuration files plus shell command history. Data is packaged into a .tar.gz and uploaded to the C2 server via PUT requests in 90-megabyte chunks.

NEW BACKDOOR MODULE. A new Objective-C backdoor (fat Mach-O, Apple Silicon + Intel) masquerades as Finder, the default macOS file manager. Its config is stored XOR-encrypted in the binary overlay (magic constant AGNT1, C2 URL, access token, build BLD-150). It communicates over HTTP with endpoints /v1/agent/ping, /v1/agent/refresh and /v1/asset/<id>. C2 commands execute attacker-supplied AppleScript and include deploy_ext (deploy a browser extension), deploy_ledger (replace the installed Ledger wallet with a C2-supplied clone), regrab (re-collect and exfiltrate system info/files packaged to /tmp/osalogging.zip), and the mystery command live_browser, which downloads and runs a component named sn_relay that Kaspersky suspects enables man-in-the-middle interception of the victim's browser traffic. Persistence is established via a LaunchAgent named com.apple.finder.agent, injection into .zshrc running a .repair-run script at every shell startup, and injection of the same script into global Git pre-commit and post-checkout hooks; on macOS older than 13.0 a helper registers the backdoor as a Login Item. The malware terminates notification processes (BTMNotificationAgent, NotificationCenter, BackgroundTaskManagementAgent) to hide the new LaunchAgent from the user.

ANTI-ANALYSIS. The malware employs ptrace with the PT_DENY_ATTACH flag for debugger evasion, sysctl checks of kern.hv_vmm_present and machdep.cpu.brand_string for VM detection, quarantine removal and extended-attribute stripping, ad-hoc code signing of downloaded bundles, deletion of temp files and logs after execution, /tmp/*.lock files to prevent re-execution, and buffer zeroing in the decryption utility.

DEFENSE. Mitigations include not executing commands found online, avoiding DMG downloads from suspicious or promotional sources, treating admin password prompts with caution, and monitoring for the com.apple.finder.agent LaunchAgent and .repair-run persistence artifacts.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1622 Debugger Evasion

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.007 JavaScript

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Discovery

T1082 System Information Discovery

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.001 Credentials from Password Stores: Keychain

Persistence

T1543.001 Create or Modify System Process: Launch Agent; T1546.004 Event Triggered Execution: Unix Shell Configuration Modification; T1546.008 Accessibility Features

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Initial Access

T1566.002 Phishing: Spearphishing Link

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• Keep macOS updated to the current release
• Update Ledger and other crypto wallet apps from official sources only

Immediate actions

• Do not download or run DMG/APP files from promotional, social-media, or unofficial links (e.g. fake 'Toria' wallet)
• Do not execute commands copied from web pages (ClickFix) or feed text into a terminal
• Revoke and rotate any credentials, browser logins, and crypto-wallet secrets that may have been exfiltrated
• Block the C2 / payload domains (apple03cloudstore.com, appstore.com.mx, warpcast.asia) at the perimeter, DNS and proxy

Workarounds

• Disable or monitor public iCloud calendar subscriptions that are not user-created
• Avoid clicking software-promotion links on X and Telegram

Longer-term hardening

• Deploy macOS endpoint protection with behavioral detection for ad-hoc-signed binaries, xattr -cr quarantine removal, and ptrace PT_DENY_ATTACH
• Monitor for the com.apple.finder.agent LaunchAgent, .zshrc injection, and global Git pre-commit/post-checkout hooks (.repair-run)
• Restrict and audit admin-password prompts; educate users on PAM/impersonated-password-prompt attacks
• Enable FileVault and strong Keychain/account policies; audit public iCloud calendar subscriptions
• Review and harden Git configuration and shell startup files against tampering

Timeline

• 2025-04-01 MacSync Swift-based macOS infostealer first emerges, derived from the AMOS (Atomic macOS Stealer) family
• 2025-06-01 MacSync distributed as malware-as-a-service, initially advertised on the dark web as 'Mac.c' before being renamed MacSync
• 2026-07-01 PAM-based admin-password verification technique, previously seen in the July 2026 'Pam Stealer' family, is adopted by MacSync
• 2026-09-01 Significantly more complex MacSync version with binary payloads and a new Objective-C backdoor module first observed in the wild, delivered via fake apps, the 'Toria' wallet and ClickFix
• 2026-09-17 Kaspersky discloses the new MacSync version via press release; public iCloud calendar command channel and Finder-disguised backdoor detailed
• 2026-09-24 Kaspersky publishes full technical analysis on Securelist; BleepingComputer reports the abuse of public iCloud calendars as a payload-delivery command channel

Sources cited

• MacSync under the microscope: new delivery methods and a new payload (Kaspersky Securelist) Kaspersky Securelist · Research · 2026-09-24
• Kaspersky discovers a new version of MacSync malware stealing credentials and crypto from macOS users kaspersky.co.uk · Vendor report · 2026-09-17
• MacSync Under The Microscope: New Delivery Methods And A New Payload (Hendry Adrian) hendryadrian.com · Research · 2026-09-24
• MacSync malware uses public iCloud calendars to deliver new payloads BleepingComputer · News · 2026-09-24
• MacSync malware uses public iCloud Calendar files to target Mac crypto users davefinances.com · News · 2026-09-17
• New version of MacSync hits macOS users it-online.co.za · News · 2026-09-21

More in malware

• PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)

Previous and next in malware

• Carbonato botnet: AI-agent-driven worm hijacks unauthenticated Docker daemons on port 2375 and installs the Hermes Agent 'GH0ST' implant Previous report
• TokenGrabber: Python-based MaaS Infostealer Builder Next report