# MacSync macOS infostealer abuses public iCloud calendars as a command channel to deliver a new backdoor module

> MacSync, a Swift-based macOS infostealer first seen in April 2025 and derived from the AMOS (Atomic macOS Stealer) family, now ships a significantly more complex build that abuses public iCloud calendar events (.ics) as a command channel: a downloader feeds calendar data to zsh and executes commands hidden after the DESCRIPTION: line, fetching a malicious archive from iCloud. The chain stages a dropper that installs the MacSync infostealer plus a new Objective-C backdoor masquerading as Finder, with persistence via LaunchAgent, .zshrc, and global Git hooks, remote AppleScript execution, browser-extension and Ledger-wallet replacement, and system-info exfiltration.

- **Published:** 2026-09-24T00:00:00Z
- **Last reviewed:** 2026-09-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2641
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-macsync-calendar-delivery-tl-2026-2641.webp?v=8d383685 (Threadlinqs threat intel: MacSync macOS Stealer iCloud Calendar C2: Detection & IOCs (TL-2026-2641) — High severity, 26 IOCs, 9 detection rules.)
- **ID:** TL-2026-2641
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)

## Description

MacSync is a Swift-based macOS infostealer distributed as malware-as-a-service. It first emerged in April 2025 as part of the AMOS (Atomic macOS Stealer) lineage; Kaspersky tracks it as Trojan.OSX.MacSync and notes it was initially advertised on the dark web as 'Mac.c' before being renamed MacSync. In September 2026 Kaspersky observed a substantially more advanced version with binary payloads and a new backdoor module, delivered via new infection chains targeting developers and cryptocurrency users.

DELIVERY. Infection begins from DMG images distributed as fake or cracked applications, a nonexistent crypto wallet called 'Toria' promoted on X and Telegram (toria.app), and ClickFix-style social engineering campaigns disguising the malware as Homebrew and macOS disk-space analyzer tools. The DMG contains an .APP bundle that removes the com.apple.quarantine attribute (xattr -cr) and extracts an XOR-encrypted URL from its overlay (key bytes 'sonomabld'; overlay read backwards with magic word SONOMAC1) that fetches the next-stage downloader.

NOVEL ICLOUD CALENDAR COMMAND CHANNEL. In one variant the downloader fetches commands hidden in the description of a public iCloud calendar event (.ics format hosted on caldav.icloud.com). It launches zsh -s reading stdin from a pipe and feeds the calendar contents line by line; most text produces shell errors, but commands placed after the DESCRIPTION: line execute and download a .TAR.GZ archive from iCloud (gateway.icloud.com) containing an .APP dropper. The operator abuses Apple's own infrastructure rather than attacker-controlled domains, making the channel low-cost and hard to block. The archive is stripped of quarantine and extended attributes, ad-hoc code signed, and executed.

MULTI-STAGE DECRYPTION CHAIN. Payloads are delivered through layered obfuscation: zlib-compressed executables wrapped in AES-CBC, then AES-GCM, using a custom 'pkgunpack' utility implementing ECDH key exchange on Curve25519 (open-source curve25519_donna) to derive per-payload keys. Modules are decrypted to /tmp/.sys-<16-digit> paths, and pkgunpack zeroes key buffers after each stage to impede forensics and dynamic analysis. A custom X-Upload-Token HTTP header is required for C2 communications.

INFOSTEALER. The Swift stealer requests the admin password through a window impersonating the targeted app and verifies it using the PAM API (a technique first seen in the July 2026 'Pam Stealer' family) rather than dscl, then displays a fake 'app is damaged - move to Trash' dialog as a distraction. It collects browser history, cookies, saved credentials and crypto-wallet-extension data, crypto wallet application data, Telegram data, the Keychain file, device login/password, system information (installed apps, processes, model, UUID), and SSH, ZSH, AWS, Kubernetes and Git configuration files plus shell command history. Data is packaged into a .tar.gz and uploaded to the C2 server via PUT requests in 90-megabyte chunks.

NEW BACKDOOR MODULE. A new Objective-C backdoor (fat Mach-O, Apple Silicon + Intel) masquerades as Finder, the default macOS file manager. Its config is stored XOR-encrypted in the binary overlay (magic constant AGNT1, C2 URL, access token, build BLD-150). It communicates over HTTP with endpoints /v1/agent/ping, /v1/agent/refresh and /v1/asset/<id>. C2 commands execute attacker-supplied AppleScript and include deploy_ext (deploy a browser extension), deploy_ledger (replace the installed Ledger wallet with a C2-supplied clone), regrab (re-collect and exfiltrate system info/files packaged to /tmp/osalogging.zip), and the mystery command live_browser, which downloads and runs a component named sn_relay that Kaspersky suspects enables man-in-the-middle interception of the victim's browser traffic. Persistence is established via a LaunchAgent named com.apple.finder.agent, injection into .zshrc running a .repair-run script at every shell startup, and injection of the same script into global Git pre-commit and post-checkout hooks; on macOS older than 13.0 a helper registers the backdoor as a Login Item. The malware terminates notification processes (BTMNotificationAgent, NotificationCenter, BackgroundTaskManagementAgent) to hide the new LaunchAgent from the user.

ANTI-ANALYSIS. The malware employs ptrace with the PT_DENY_ATTACH flag for debugger evasion, sysctl checks of kern.hv_vmm_present and machdep.cpu.brand_string for VM detection, quarantine removal and extended-attribute stripping, ad-hoc code signing of downloaded bundles, deletion of temp files and logs after execution, /tmp/*.lock files to prevent re-execution, and buffer zeroing in the decryption utility.

DEFENSE. Mitigations include not executing commands found online, avoiding DMG downloads from suspicious or promotional sources, treating admin password prompts with caution, and monitoring for the com.apple.finder.agent LaunchAgent and .repair-run persistence artifacts.

## MITRE ATT&CK

- T1566.002 Phishing: Spearphishing Link
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.007 JavaScript
- T1543.001 Create or Modify System Process: Launch Agent
- T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
- T1546.008 Accessibility Features
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1622 Debugger Evasion
- T1070.004 Indicator Removal: File Deletion
- T1555.001 Credentials from Password Stores: Keychain
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**MacSync iCloud Calendar Command Channel — zsh Executing Fetched Commands** (`TL-2026-2641-SPL-001`)

Detects the novel command-and-delivery channel used by the MacSync downloader: a Unix shell (zsh/bash) is launched reading stdin from a pipe and fed the contents of a public iCloud calendar event (.ics) fetched from caldav.icloud.com, executing commands placed after the DESCRIPTION: line that download a .tar.gz dropper archive from gateway.icloud.com. This abuses Apple's own infrastructure rather than attacker domains.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.004, T1105, T1071.001
- **Data sources:** osquery, macos_unified_log
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="osquery:results"
  | search (name="zsh" OR name="bash" OR name="sh")
  | regex cmdline="(?i)(caldav\.icloud\.com|gateway\.icloud\.com|DESCRIPTION|\.ics|\.tar\.gz|zsh\s+-s)"
  | search (cmdline="*curl*" OR cmdline="*wget*" OR cmdline="*python3*")
  | table _time host user name cmdline
  | sort - _time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("caldav.icloud.com", "gateway.icloud.com", ".tar.gz", ".ics", "zsh -s")
| where ProcessCommandLine has_any ("curl", "wget", "python3", "zsh -s")
| where FileName in~ ("zsh", "bash", "sh", "curl", "wget")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
```

### Sigma

```yaml
title: MacSync macOS Infostealer - Suspicious Shell Download and Quarantine Bypass
id: 4f9c2d7a-6b1e-4a3c-9d8e-2f0c1a3b5d71
status: experimental
description: Detects a Unix shell (zsh/bash) reading remote content from a pipe and executing it, downloading archives from iCloud or attacker-controlled hosts, and stripping the quarantine attribute with xattr -cr, consistent with the MacSync macOS infostealer delivery chain.
references:
  - https://securelist.com/macsync-new-version/121383/
  - https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/
author: Threadlinqs Team
date: 2026/09/24
tags:
  - attack.execution
  - attack.t1059.004
  - attack.defense_evasion
  - attack.t1140
  - attack.t1070.004
  - attack.tool.macsync
logsource:
  category: process_creation
  product: macos
detection:
  selection_shell:
    Image|endswith:
      - '/zsh'
      - '/bash'
      - '/sh'
  selection_remote:
    CommandLine|contains|all:
      - 'curl'
    CommandLine|contains:
      - 'caldav.icloud.com'
      - 'gateway.icloud.com'
      - '.tar.gz'
      - '.ics'
  selection_stdin:
    CommandLine|contains:
      - 'zsh -s'
      - 'bash -s'
      - 'python3 -'
  selection_quarantine:
    CommandLine|contains|all:
      - 'xattr'
      - '-cr'
  condition: selection_shell and (selection_remote or selection_stdin or selection_quarantine)
falsepositives:
  - Developers legitimately fetching Homebrew or tool installers hosted on iCloud
  - Scripts that pipe remote content into a shell as part of automated provisioning
level: high
```

**Known false positives:**

- Developers scripting legitimate downloads from iCloud/Homebrew
- Automated provisioning scripts that pipe remote content into a shell

**Tuning notes:** Baseline legitimate iCloud calendar fetches and Homebrew installs; alert when a shell reads stdin (zsh -s) in combination with a .tar.gz download from gateway.icloud.com/caldav.icloud.com. Correlate with a subsequent non-Apple-blessed .app execution.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MacSync Finder-Masquerading Backdoor Process Execution (locked: unlock with TL Creds)
- MacSync Credential Theft and Data Collection — Keychain, Browser and Config Files (locked: unlock with TL Creds)
- MacSync Backdoor Remote Command Execution — AppleScript and Defense Impairment (locked: unlock with TL Creds)
- MacSync Dropper — Ad-hoc Signed Bundle and Quarantine Removal (locked: unlock with TL Creds)
- MacSync Login Item and Shell/Git Persistence Chain (locked: unlock with TL Creds)
- MacSync Network C2 and Exfiltration — Abused Apple Infrastructure (locked: unlock with TL Creds)
- MacSync Persistence — Finder LaunchAgent, .zshrc and Global Git Hook Injection (locked: unlock with TL Creds)
- MacSync Backdoor C2 — /v1/agent HTTP Beaconing and Chunked Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- Domain: `docsend[.]appstore[.]com[.]mx`
- File hash: `26a0f7cdb9f7dc5ace9a40af825b1538`
- Domain: `streamyard[.]appstore[.]com[.]mx`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [MacSync malware uses public iCloud calendars to deliver new payloads](https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/)
- [MacSync under the microscope: new delivery methods and a new payload (Kaspersky Securelist)](https://securelist.com/macsync-new-version/121383/)
- [Kaspersky discovers a new version of MacSync malware stealing credentials and crypto from macOS users](https://www.kaspersky.co.uk/about/press-releases/kaspersky-discovers-a-new-version-of-macsync-malware-stealing-credentials-and-crypto-from-macos-users)
- [MacSync Under The Microscope: New Delivery Methods And A New Payload (Hendry Adrian)](https://www.hendryadrian.com/macsync-under-the-microscope-new-delivery-methods-and-a-new-payload/)
- [MacSync malware uses public iCloud Calendar files to target Mac crypto users](https://davefinances.com/macsync-malware-uses-public-icloud-calendar-files-to-target-mac-crypto-users/)
- [New version of MacSync hits macOS users](https://it-online.co.za/2026/09/21/new-version-of-macsync-hits-macos-users/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2641