iCloud (Product): news timeline & CVEs

MacSync info-stealing malware hides malicious commands in an iCloud calendar

Kaspersky says a new MacSync macOS infostealer hides commands in an iCloud calendar and steals credentials and wallets.

Kaspersky reported a September 2026 MacSync variant delivered through a fake crypto wallet app called Toria and promoted on X and Telegram. The chain uses DMG droppers, Swift and Objective-C binaries, and in one case shell commands hidden after the DESCRIPTION line of a public iCloud calendar. The stealer prompts for an administrator password through the PAM API, then collects browser secrets, wallets, Keychain, Telegram, SSH, AWS, Kubernetes, and Git data. An Objective-C backdoor masquerades as Finder, persists via a LaunchAgent, .zshrc, and Git hooks, and can run attacker AppleScript.

Help Net SecuritySep 25, 09:22 UTC · 1d agoMalware in the wild 4 sources

MacSync malware uses public iCloud calendars to deliver new payloads

MacSync macOS infostealer now pulls new payloads from public iCloud calendar events and adds a persistent backdoor.

Kaspersky reports a new MacSync macOS infostealer variant that hides next-stage commands in the description of a public iCloud calendar event. A downloader feeds that text to zsh, which fetches an archive and an app-bundle dropper that ultimately installs MacSync. The stealer still harvests browser data, Keychain, crypto wallets, Telegram, and cloud and shell credentials. A new Objective-C backdoor, disguised as Finder, persists through a LaunchAgent, .zshrc changes, and global Git hooks, and can run AppleScript and replace a Ledger wallet app.

BleepingComputerupdated Sep 25, 09:22 UTC · 1d agofirst Sep 24, 20:53 UTC · 2d agoMalware in the wild 4 sources

iCloud

Timeline2 articles

Appears with

MacSync info-stealing malware hides malicious commands in an iCloud calendar

MacSync malware uses public iCloud calendars to deliver new payloads