A calendar invite is not supposed to run code. In a new version of the MacSync macOS stealer, it effectively does: one stage of the infection downloads a public iCloud calendar whose event description carries the attackers' next commands, researchers at Kaspersky report.
MacSync is sold as malware as a service, so each operator chooses how to reach victims. In the report, Kaspersky's Sergey Puzan describes the family's biggest overhaul yet, first seen in the wild this month: script droppers replaced by compiled binaries, a main payload rewritten in Objective-C and Swift, and a backdoor module aimed squarely at cryptocurrency users and developers.
A fake wallet with its own marketing
One campaign pushed a nonexistent crypto wallet app called Toria, complete with a dedicated website and promotion on X and Telegram. Other lures posed as installers for business tools. The infection starts with a disk image. The app inside strips macOS's quarantine flag from itself, fetches the next stage (in at least one sample, from the public iCloud calendar), and passes through a chain of encrypted droppers that check for virtual machines and block debuggers before the real payload runs.
Using Apple's own infrastructure for a delivery stage is the notable choice here. Traffic to an iCloud calendar looks far more ordinary on a corporate network than a download from a freshly registered domain.
What it takes, and what it leaves behind
The stealer module asks for the administrator password with a window styled to match the app it impersonates, then shows a fake system warning that the app is damaged. Kaspersky notes it checks the password through macOS's PAM authentication interface rather than the usual command-line utility, a technique it first saw in the wild in July in a family called Pam Stealer.
It collects browser history, cookies, saved passwords and wallet extension data, desktop wallet data, Telegram data, the login keychain, shell history, and configuration files for SSH, AWS, Kubernetes and Git, which is why developers are in the crosshairs. A keychain-access feature appears to be unfinished and was disabled in every sample.
The backdoor disguises itself as Finder and persists three ways: a LaunchAgent named com.apple.finder.agent, a line added to the user's .zshrc, and global Git hooks that restore it if it is deleted. Its commands can install a browser extension, re-collect files, and replace an installed Ledger wallet app with a version from the attackers' server.
Check for a fake Finder agent and poisoned Git hooks
- Only install wallet and business apps from the developer's official site or the App Store, and be wary of any app that asks for your Mac password right after launch.
- Look for a LaunchAgent called com.apple.finder.agent, a folder at ~/Library/Application Support/System (it does not exist on a clean Mac), and unexpected entries in ~/.zshrc and global Git pre-commit or post-checkout hooks.
- If a Mac was infected, rotate every browser password, cloud key and SSH key it held, and move crypto funds to a wallet created on a clean device.
Selected indicators from Kaspersky, defanged:
- hxxps://toria[.]app/
- hxxps://warpcast[.]asia/Toria[.]dmg
- toria[.]apple03cloudstore[.]com
- docsend[.]appstore[.]com[.]mx
MacSync has turned up in our coverage before, most recently behind fake Claude Code install pages. This version shows where Mac malware is heading: fewer quick scripts, more compiled, layered code, and a willingness to borrow Apple's own services as cover.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.