What happened (short version)

There’s a fresh twist in macOS malware theater: a Swift-based infostealer called MacSync has started sneaking new payloads into public iCloud calendars. Instead of a shiny phishing email or sketchy DMG, attackers are hiding commands inside calendar event descriptions that a tiny downloader pipes into zsh — and voilà, the next-stage payload downloads itself.

MacSync first appeared in 2025 and has been pushed using social-engineering tricks like fake utilities, cracked apps, and lure pages that promise helpful tools. The malware has evolved modularly over time, adding capabilities beyond simple credential theft.

How it works, and what it steals

There are two delivery methods in recent campaigns. The more elaborate chain looks like this:

  • A small downloader pulls the text of a public iCloud calendar event.
  • The downloader feeds that text into macOS’s zsh. Most of the gibberish just triggers harmless errors, but anything placed after the event’s DESCRIPTION: tag is treated as a shell command and executed.
  • Those commands fetch an archive from iCloud, which contains an APP bundle dropper. The dropper then stages additional components that eventually run MacSync.

Once active, the malware behaves like a classic info-stealer: it grabs browser history, cookies, saved credentials, crypto wallet extension and app data, Telegram files, the Keychain file, system and device information, SSH keys, AWS/Kubernetes/Git configs, and shell dotfiles.

Researchers also found a new Objective-C backdoor module that pretends to be Finder. Its installer tries hard to survive reboots and avoid detection by:

  • Installing a LaunchAgent entry.
  • Modifying the user’s .zshrc so it runs again at shell start.
  • Adding global Git hooks.
  • Terminating macOS notification processes so pop-up warnings don’t bother the user.

The backdoor can:

  • Execute AppleScript provided by the attackers from a command server.
  • Install or swap browser extensions and even replace a wallet app with a tampered version.
  • Collect extra files and system info and upload them to the attacker’s server.
  • Verify and re-establish persistence so it survives reboots.

There’s also a mysterious live_browser command that downloads a component named sn_relay, whose exact role is still unclear — because malware researchers didn’t have the AppleScript payloads available, some behavior was inferred from command names and status messages.

Practical tips — don’t be the low-hanging fruit

If this sounds oddly clever and slightly terrifying, that’s because it is. A few sensible habits cut risk dramatically:

  • Don’t paste and run random terminal commands you find online.
  • Avoid downloading DMG or installer files from untrusted sites or sketchy pages promising freebies.
  • Be suspicious of any prompt that asks for an admin password — pause, verify the app, and check the origin.
  • Inspect LaunchAgents, cron jobs, and unusual global Git hooks if you suspect a compromise.
  • Stick to official app stores or vendor pages, keep macOS and apps updated, and keep backups.

MacSync is a reminder that attackers will hide payloads in unexpected places. Treat anything that runs shell commands on your machine like a potential accomplice and stay a little paranoid — it pays off.