MacSync info-stealing malware hides malicious commands in an iCloud calendar

A new MacSync variant targets Mac users with an infostealer and persistent backdoor designed to steal credentials, crypto wallet data, and files, according to Kaspersky.

Researchers found the malware spreading through a crypto wallet app called Toria, which had its own website and was promoted on X and Telegram.

MacSync is a family of Mac malware that emerged in 2025 as Mac.c and was later renamed. Early versions used AppleScripts that closely resembled the AMOS stealer, while newer variants added a backdoor module. Kaspersky first spotted the latest version in September 2026.

“The new version of the MacSync infostealer differs quite significantly from its previously observed variants. The attackers have substantially overhauled their approach to executing the stealer’s and backdoor’s main malicious payload, moving from AppleScripts to full-fledged executable files written in Swift and Objective-C,”explained Sergey Puzan, Malware Analyst at Kaspersky.

“It’s also worth noting the more complex infection chain: instead of obfuscated shell scripts delivered through ClickFix attacks, this version used binary droppers and loaders, some of which leveraged Apple’s infrastructure as one of the intermediate stages for delivering the malicious payload,” he added.

Commands hidden in a calendar event

Kaspersky identified two ways the infostealer and backdoor were delivered within a single campaign built around one fake app. In the first, the DMG contained a compiled JXA script that decoded a shell script and passed it straight to the interpreter without writing it to disk.

In the second, the same script appeared only after a chain of droppers and loaders had run. This longer chain starts with an app inside the DMG. When launched, it removes the quarantine attribute from itself and decrypts a hidden link to the next-stage downloader script.

In some samples, the link pointed to a file on an attacker-controlled server. In at least one, it pointed to a public iCloud calendar. The downloader feeds the calendar file line by line into the zsh shell, which treats the lines as invalid commands until it reaches the malicious commands placed after the DESCRIPTION: line. Those commands download an archive from iCloud containing another app, which is signed with an ad-hoc signature and launched.

That app is a dropper that unpacks a second dropper. The second one checks whether it is running in a virtual machine, blocks debuggers from attaching, and delivers a script that downloads the next stage from the attackers’ server. At almost every stage, the malware removes its temporary files and logs once its task is done.

Fake prompts and a long list of stolen data

The stealer asks for the administrator password in a window styled to match the app it impersonates. Once the password is entered, it shows a fake system notice saying the app is damaged and offering to move it to the trash.

Fake password prompt and damaged app warning (Source:Kaspersky)

“Interestingly, instead of the method most macOS malware families use to verify a password, the dscl utility, the attackers used the Pluggable Authentication Modules (PAM) API. This is a fairly new technique for macOS malware, first observed in the wild in July 2026 in the Pam Stealer family,” Puzan noted.

The stealer collects browser history, cookies, saved logins and passwords, and crypto wallet extension data. It also takes crypto wallet app data, Telegram data, the device login and password, the Keychain file, and system information such as installed apps, running processes and the device model.

Configuration files for SSH, zsh, AWS, Kubernetes and Git are targeted too, along with zsh and Bash command history and the user’s profile picture.

Kaspersky also found a feature that is disabled in all samples discovered so far. It changes access settings on Keychain entries so they can be read without user confirmation, but in its current form a confirmation prompt still appears.

A backdoor posing as Finder

The backdoor, written in Objective-C, disguises itself as Finder. It restarts through a LaunchAgent named com.apple.finder.agent, a command added to the .zshrc file, and commands added to global Git pre-commit and post-checkout hooks.

A helper script restores the backdoor from a backup copy if its files are missing. It also kills the BTMNotificationAgent, NotificationCenter and BackgroundTaskManagementAgent processes to stop macOS from notifying the user about the new LaunchAgent.

The backdoor runs AppleScript sent by the attackers’ server. Kaspersky did not have these scripts and worked out what each command does from its name and the messages sent back to the server. The commands let the attackers:

• deploy a browser extension
• replace the installed Ledger wallet app with a version from the server
• collect system information and files again
• download and run a file called sn_relay

Researchers could not determine what sn_relay does. Based on the name of the command that launches it, live_browser, and the messages sent to the server, they assume the attackers intercept traffic from the victim’s browser.

“The nature of the data attackers seek to collect from a victim’s device, as well as the categories of applications the stealer disguises itself as, clearly indicates that this malware family primarily targets developers, crypto enthusiasts, and other users associated in some way with IT and the crypto space,”

“MacSync’s compromise of software developers’ devices poses particular security risks for both end users and corporate systems, opening up expanded opportunities for attackers to further their intrusion,” concluded Puzan.