MacSync info-stealing malware hides malicious commands in an iCloud calendar
Kaspersky says a new MacSync macOS infostealer hides commands in an iCloud calendar and steals credentials and wallets.
Kaspersky reported a September 2026 MacSync variant delivered through a fake crypto wallet app called Toria and promoted on X and Telegram. The chain uses DMG droppers, Swift and Objective-C binaries, and in one case shell commands hidden after the DESCRIPTION line of a public iCloud calendar. The stealer prompts for an administrator password through the PAM API, then collects browser secrets, wallets, Keychain, Telegram, SSH, AWS, Kubernetes, and Git data. An Objective-C backdoor masquerades as Finder, persists via a LaunchAgent, .zshrc, and Git hooks, and can run attacker AppleScript.
- Fake Toria crypto wallet app delivered MacSync via DMG droppers.
- One chain hid shell commands after an iCloud calendar DESCRIPTION line.
- Stealer uses the PAM API for the admin password, not dscl.
- Backdoor persists as a fake Finder LaunchAgent and Git hooks.
- Targets browsers, Keychain, wallets, SSH, AWS, Kubernetes, and Git data.
From the original article
4 min read at helpnetsecurity.com
A new MacSync variant targets Mac users with an infostealer and persistent backdoor designed to steal credentials, crypto wallet data, and files, according to Kaspersky. Researchers found the malware spreading through a crypto wallet app called Toria, which had its own website and was promoted on X and Telegram. MacSync is a family of Mac malware that emerged in 2025 as Mac.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.