Mac malware can hide commands in your iCloud calendar

Understanding MacSync malware

You probably use your calendar to keep track of appointments, birthdays and the occasional reminder you immediately snooze. Hackers apparently see another possibility. Security researchers have uncovered a new version of MacSync malware that can use a public iCloud calendar event as part of its infection chain. Hidden inside the calendar data are commands that help download more malware onto a Mac.

The calendar itself does not suddenly infect your computer because someone sent you an invitation. The attack starts earlier, usually after someone downloads and runs a malicious app. Still, the iCloud trick shows how attackers can hide parts of an attack behind familiar services many of us trust. Once MacSync gets inside, it can go after a lot more than your calendar.

MacSync is an information-stealing malware family targeting macOS. Earlier versions shared similarities with the Atomic macOS Stealer, better known as AMOS. Researchers say MacSync has since developed additional capabilities of its own. Kaspersky says the malware first appeared on the dark web in 2025 under the name Mac.c. Its creators later renamed it MacSync. Researchers first spotted this newest version in the wild in September 2026.

MacSync operates under a malware-as-a-service model. That means different criminals can use the malware while choosing their own methods for getting it onto someone's Mac. Attackers have previously spread MacSync through social engineering and ClickFix-style attacks, where a bogus message tells someone to copy and run a command. Criminals have also disguised it as free software, cracked applications and unfamiliar new apps.

How hackers abuse iCloud calendars

Here's where this latest version gets particularly sneaky. Kaspersky found one MacSync infection chain where a downloader connected to a public iCloud calendar. Instead of using the calendar to schedule anything, the attackers placed malicious commands inside the event description. The malware then feeds that calendar information into the Mac's Zsh command-line shell.

Most of the calendar text produces errors because the Mac does not recognize normal calendar information as commands. However, when it reaches the malicious instructions placed after the event's description field, those commands can run. They ultimately download a compressed archive from iCloud containing another malicious app. That app then starts another stage of the infection.

Think of the calendar as a hiding place for instructions. The attacker still needs to get malicious software running on the Mac first. However, using Apple's infrastructure during the infection chain can make the activity look less suspicious. Importantly, Kaspersky says at least one sample pointed to a public iCloud calendar. Other samples used attacker-controlled servers instead.

Targeting crypto and sensitive data

Researchers also found attackers disguising MacSync as a fake cryptocurrency wallet called Toria. The criminals went beyond creating a download page. Kaspersky says they built a dedicated website for the nonexistent wallet and promoted it on X and Telegram. That is a good reminder that a polished website or active social media account tells you very little about whether software deserves your trust. Crypto owners appear to be an especially attractive target because stealing wallet data or browser extension information can quickly lead to stolen funds. However, you do not need to own cryptocurrency to have something MacSync wants.

Once installed, the information-stealing portion of MacSync searches through a wide range of sensitive data. Researchers say it can target browser history, cookies, saved logins and passwords. It also searches for crypto wallet extension data, cryptocurrency wallet applications and Telegram information. MacSync can collect the Mac user's login information and Keychain file. It also gathers system details including installed apps, running processes, hardware information and the device model.

Developers and more advanced users face additional exposure because the malware searches configuration files for SSH, ZSH, AWS, Kubernetes and Git. It can also collect Zsh and Bash command histories. For the average Mac owner, the takeaway is simpler. If malware gets access to saved passwords or browser data, an attacker may gain another route into your online accounts.

The new MacSync backdoor

Kaspersky also discovered a separate backdoor component written in Objective-C. It disguises itself as Finder, the file-management app built into macOS. The malware tries several methods to stay on the Mac after a restart. These include a LaunchAgent, changes to the .zshrc configuration file and modifications to global Git hooks. It can also terminate several macOS notification processes.

Kaspersky says this prevents the system from notifying the user about the new LaunchAgent. From there, attackers can send instructions to the infected machine. Researchers found commands designed to deploy a browser extension, replace an installed Ledger wallet app and collect additional system information or files. Most of those commands ultimately execute AppleScript supplied by the attacker's command-and-control server.

Kaspersky inferred what the individual commands do from their names and the status messages they send because researchers did not have the AppleScript payloads themselves. That limitation is important. Researchers can see what the backdoor appears designed to accomplish, but they did not observe every possible server-delivered script.

Defending against Mac-based threats

Macs include built-in security protections, but many recent attacks focus on persuading the person sitting in front of the screen to bypass those protections. ClickFix attacks are a perfect example. A website may tell you something went wrong and provide a command that supposedly fixes the problem. In reality, you may end up launching malware yourself. We've previously reported on Shamos malware, another Mac threat that used bogus troubleshooting instructions to trick people into running commands in Terminal.

According to Apple, macOS includes several layers designed to help prevent malicious software from running, including Gatekeeper, XProtect and Apple's notarization system for software downloaded outside the Mac App Store. Apple recommends the Mac App Store as the safest place to get Mac software. For apps downloaded elsewhere, Apple says macOS uses protections such as notarization and XProtect to detect known malware and block it from running.

On macOS 26.4 and later, Apple added protections aimed more directly at attacks that try to trick people into pasting commands into Terminal. Terminal paste protection can show a warning when text is pasted into Terminal from common attack sources such as web browsers, messaging apps and other communication software. Apple says XProtect can also inspect activity that starts from pasted commands, including in third-party terminal apps.