MacSync malware uses public iCloud calendars to deliver new payloads
MacSync macOS infostealer now pulls new payloads from public iCloud calendar events and adds a persistent backdoor.
Kaspersky reports a new MacSync macOS infostealer variant that hides next-stage commands in the description of a public iCloud calendar event. A downloader feeds that text to zsh, which fetches an archive and an app-bundle dropper that ultimately installs MacSync. The stealer still harvests browser data, Keychain, crypto wallets, Telegram, and cloud and shell credentials. A new Objective-C backdoor, disguised as Finder, persists through a LaunchAgent, .zshrc changes, and global Git hooks, and can run AppleScript and replace a Ledger wallet app.
- MacSync downloader reads commands from a public iCloud calendar event description.
- Retrieved text is passed to zsh, which downloads an archive containing the dropper.
- Infostealer still targets browsers, Keychain, crypto wallets, Telegram, SSH, AWS, and Git data.
- New Objective-C backdoor poses as Finder and persists via LaunchAgent, .zshrc, and Git hooks.
- Backdoor can run AppleScript, deploy browser extensions, and swap the Ledger wallet app.
From the original article
2 min read at bleepingcomputer.com
A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.