Threat intel
MacSync malware runs commands from an iCloud calendar
A Swift-based macOS stealer now reads its next commands from a public iCloud calendar event, then drops a backdoor that poses as Finder.
Kaspersky's Securelist team, along with Help Net Security and BleepingComputer, published research on September 25 and 26, 2026 on a new variant of MacSync, a macOS information stealer that first appeared in April 2025 under the name Mac.c. The new variant reads its next set of commands out of the description field of a public iCloud calendar event, then installs a backdoor that disguises itself as Finder, the file browser every Mac user already has running.
Two separate distribution campaigns are pushing it right now. One dresses up as Homebrew, the widely used macOS package manager, or as a disk-space analyzer utility, and delivers the malware through a ClickFix page: a fake error message or CAPTCHA that tells the visitor to copy a command into Terminal to fix the problem. The other is Toria, a fake cryptocurrency wallet app with its own promotional website, pushed on social media. Anyone who installs developer tools from search results, or a wallet app from a social media post rather than an app store, is a target.
How it works
The infection starts with a small downloader component, dropped by one of the two lures above. Once running, it fetches the text description of a specific calendar event on a public iCloud calendar, meaning a calendar and event that anyone, including a researcher or the attacker's own infrastructure, can view without logging into anything. That retrieved text gets fed straight into zsh, the shell that has been the default on macOS since Catalina.
Most of that calendar text is not meant to run as anything. It is written so that zsh chokes on it line by line and throws errors, which is exactly what the attacker wants an analyst glancing at a process log to see. Buried after a literal "DESCRIPTION:" line in the calendar data are the real commands, the only lines zsh can actually execute. Those lines pull down a further archive from iCloud. Inside is what looks like an ordinary macOS application bundle, the standard folder-and-manifest package format for a Mac app, carrying an ad hoc code signature. That bundle is a dropper: it unpacks and installs the further stages that bring in the MacSync stealer itself and, in this variant, an Objective-C backdoor.
Routing commands through a public calendar event is a deliberate choice, not an accident of convenience. An infected Mac reaching out to icloud.com looks like completely normal Apple-ecosystem traffic, next to every other iCloud sync request the machine already makes, where a connection to an unfamiliar command and control server would stand out on a firewall log. It also decouples the commands from the malware already sitting on a victim's disk: the operator edits the calendar event's description whenever they want to point infected machines at a new payload, with nothing to redeploy and no code on the infected machine to change.
The backdoor persists through a LaunchAgent named com.apple.finder.agent, a line added to the user's .zshrc shell startup file, and hooks planted in local Git repositories, so it restarts itself through several independent paths even if one gets cleaned up. Once running, it takes commands as AppleScript from its own command and control server, which lets the operator push new browser extensions, swap out a legitimate Ledger wallet app for a fake one, or just pull fresh system information on demand.
What attackers are doing
MacSync has been running as malware as a service since it emerged as Mac.c in April 2025, evolving from a simple AMOS-derived script stealer into modular components written in Swift and Objective-C. The September 2026 variant Securelist describes marks a shift from script-heavy delivery to compiled binaries and the calendar-based command channel.
The infostealer module targets browser-stored passwords, cookies and history, cryptocurrency wallet extensions and desktop apps, Telegram session data, macOS Keychain entries (Apple's built-in store for passwords and credentials), and configuration files and command history for SSH, AWS, Kubernetes and Git. That list covers most of what a developer or a crypto holder keeps unlocked on a daily machine. The Finder-named backdoor adds standing remote access on top: a second process called Finder does not look out of place in Activity Monitor, since the real Finder.app is always running too, so the fake one can sit there for weeks without drawing a second look.
What to do
Never paste a command from a website's error message, CAPTCHA prompt or "fix" instructions into Terminal, no matter how legitimate the surrounding page looks. That ClickFix pattern is the delivery method for this malware's Homebrew and disk-analyzer lures, and no real error dialog on macOS asks a visitor to run a shell command to resolve it.
Install Homebrew only from the command published at brew.sh, and get disk-space or system-cleanup utilities from the vendor's own site or the Mac App Store, not from a search-result ad or a download button on a page that led with an error. Treat any macOS app claiming to be a cryptocurrency wallet as high risk if you found it through a social media post rather than the Mac App Store or the wallet project's own long-established site; check the domain and the developer name against what the project publishes elsewhere before opening a DMG file.
How to check for compromise
Open Activity Monitor, or run ps aux and launchctl list from Terminal, and look for a second process named Finder, or anything imitating Finder that is not the genuine, code-signed application at /System/Library/CoreServices/Finder.app. Run codesign -dv --verbose=4 against any Finder-named binary you cannot immediately explain and confirm it comes back signed by Apple. Also check ~/Library/LaunchAgents for a plist named com.apple.finder.agent, which is not one Apple ships.
Review outbound connections for repeated requests to icloud.com calendar or CalDAV endpoints coming from a process other than the real Calendar app; a network monitor or your firewall's connection log will show the responsible process name. Check your .zshrc for lines you did not add, and look at the pre-commit and post-checkout hooks in any local Git repository for content you do not recognize. Finally, review Keychain Access logs, or the unified log with log show, for credential reads by a process name that has no business touching your passwords.
There is no patch here because MacSync does not exploit a vulnerability; it depends on someone running a command or installing an app they were led to trust. Our safeguarding and hardening team can set the endpoint policy that blocks unsigned installers and unapproved LaunchAgents before this reaches a device, and our security operations team can build the detection that flags a second Finder process or an unexpected calendar callout the moment it happens. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: Help Net Security, HotHardware, Netmanageit, OffSeq Threat Radar, Securelist, BleepingComputer.