# MacSync (Mac.c) macOS Info-Stealer Abuses Public iCloud Calendars as C2 Dead-Drop in Fake "Toria" Crypto Wallet Campaign

> Kaspersky (researcher Sergey Puzan) identified a new version of the MacSync (aka Mac.c) macOS infostealer distributed via a fake cryptocurrency wallet app named Toria, promoted on X and Telegram. The malware's six-stage infection chain hides a downloader link inside a public iCloud calendar event and ultimately deploys a Swift/Objective-C infostealer and a Finder-disguised backdoor that harvest browser, crypto-wallet, Keychain, SSH/AWS/Kubernetes/Git, and Telegram data.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2723
- **ID:** TL-2026-2723
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MacSync, first observed in 2025 under the name Mac.c as an AppleScript-based stealer resembling the AMOS (Atomic macOS Stealer) family, resurfaced in September 2026 with a substantially reworked, compiled Swift/Objective-C payload and a novel command-delivery mechanism. The current campaign lures victims -- primarily macOS developers, IT-associated users, and cryptocurrency holders -- with a fake wallet application called "Toria," advertised via a dedicated website (toria.app) and promoted through X and Telegram accounts.

The infection begins with a malicious DMG containing a compiled JXA loader that strips the macOS quarantine attribute (xattr -cr) and decodes an XOR-encrypted (key 73 6f 6e 6f 6d 61 62 6c 64 07) downloader URL. That URL points to a public iCloud CalDAV calendar (caldav.icloud[.]com/published/2/...); the loader fetches the calendar's raw text and pipes it to zsh. Most of the calendar body is inert text that produces shell errors, but the malware places live commands immediately after the event's DESCRIPTION: field, which zsh executes -- a dead-drop technique that abuses a legitimate Apple sharing feature and leaves no attacker-controlled infrastructure in the initial fetch. Those commands retrieve an AES-CBC-encrypted TAR.GZ (first dropper), which in turn unpacks a second dropper that performs VM detection (sysctl kern.hv_vmm_present, machdep.cpu.brand_string) and sets PT_DENY_ATTACH to block debuggers before decrypting and executing a fifth-stage script. That script downloads the final infostealer and backdoor modules using a custom pkgunpack utility implementing Curve25519 ECDH key exchange and AES-GCM decryption.

The backdoor persists via a LaunchAgent labeled com.apple.finder.agent (masquerading as Finder), a .zshrc modification that runs a hidden .repair-run recovery script, and global git pre-commit/post-checkout hooks. The .repair-run script restores backdoor files from a backup at $HOME/Library/Application Support/System if they are removed, and kills BTMNotificationAgent, NotificationCenter, and BackgroundTaskManagementAgent to suppress macOS's background-task notifications. The backdoor exposes AppleScript-wrapped commands including deploy_ext (malicious browser extension installation), deploy_ledger (Ledger hardware-wallet software replacement), regrab (re-collects host data into /tmp/osalogging.zip), and live_browser (an adversary-in-the-middle traffic interceptor via an sn_relay component).

The infostealer module harvests browser history, cookies, saved credentials and Safe Storage keys (Chrome, Brave), cryptocurrency wallet extension/app data, Telegram files, the Keychain file, SSH/zsh/AWS/Kubernetes/Git configuration files, shell command history, and system/process/application inventory. Collected data is uploaded to the C2 over authenticated PUT requests (custom X-Upload-Token header) in 90-megabyte chunks via a documented REST API (GET /v1/agent/ping, POST /v1/agent/refresh, POST /v1/asset/<id>/init, PUT /v1/asset/<id>). C2 and staging infrastructure impersonates well-known brands (Apple App Store, Slack, StreamYard) under domains such as toria.apple03cloudstore[.]com, docsend.appstore[.]com[.]mx, streamyard.appstore[.]com[.]mx, slack.apple03cloudstore[.]com, and waaako.appstore[.]com[.]mx.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1204.002 User Execution: Malicious File
- T1036.005 Match Legitimate Resource Name or Location
- T1553.001 Subvert Trust Controls: Gatekeeper Bypass
- T1027 Obfuscated Files or Information
- T1622 Debugger Evasion
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1685 Disable or Modify Tools
- T1543.001 Create or Modify System Process: Launch Agent
- T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
- T1176 Software Extensions
- T1555.001 Credentials from Password Stores: Keychain
- T1552.001 Unsecured Credentials: Credentials In Files
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1005 Data from Local System
- T1074.001 Data Staged: Local Data Staging

## Sources

- [MacSync info-stealing malware for macOS](https://www.helpnetsecurity.com/2026/09/25/macsync-info-stealing-malware-for-macos/)
- [A new version of the MacSync macOS stealer targets crypto enthusiasts and developers](https://securelist.com/macsync-new-version/121383/)
- [MacSync malware uses public iCloud calendars to deliver new payloads](https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/)
- [New MacSync Malware Turns macOS Apps Into Tools for Crypto and Password Theft](https://cybersecuritynews.com/new-macsync-malware/)
- [MacSync macOS Infostealer Adds Binary Payloads, iCloud Abuse](https://www.technadu.com/macsync-macos-stealer-returns-with-binary-payloads-and-icloud-tricks/638689/)
- [MacSync's New Infection Chain Shows How Mac Malware Is Becoming More Sophisticated](https://cyberpress.org/macsync-malware-evolves-its-tactics/)
- [MacSync malware uses public iCloud calendars to deliver new payloads](https://www.prsol.cc/2026/09/26/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2723