MacSync malware, active since April 2025, has developed a novel delivery mechanism using public iCloud calendar events to hide commands that fetch subsequent payloads from iCloud. The malware is distributed via social engineering, including fake crypto wallets and cracked software. Its infostealer module targets sensitive data such as browser history, cookies, crypto wallet data, Telegram, Keychain, and system configuration files. The newly observed backdoor module, written in Objective-C, masquerades as the macOS Finder app, establishes persistence through LaunchAgents, .zshrc modifications, and Git hooks, and disables macOS notifications to avoid user alerts. It can execute AppleScript commands from its command-and-control server, deploy malicious browser extensions or replace legitimate Ledger wallet apps, collect system information, and maintain persistence after reboot. A component named sn_relay was also identified but its function remains unclear. The malware's evolving techniques increase its evasiveness and effectiveness against macOS users.

The malware can steal a wide range of sensitive data including browser credentials, crypto wallet information, Telegram data, and system files. The backdoor module allows remote execution of commands, deployment of malicious extensions or apps, data exfiltration, and persistence on infected macOS systems. It also suppresses user notifications to avoid detection. These capabilities enable attackers to maintain long-term access and control over compromised systems, potentially leading to significant data breaches and unauthorized access to user accounts and assets.

No official patch or vendor advisory is provided for this malware. Users should avoid executing commands found online, refrain from downloading DMG files from untrusted or suspicious sources, and treat admin password prompts with caution. Employing endpoint protection solutions capable of detecting MacSync and related malware variants is recommended. Monitoring for unusual persistence mechanisms such as LaunchAgents, .zshrc modifications, and unexpected Git hooks may help identify infections. Users should also be cautious about social engineering campaigns promoting fake crypto wallets or cracked software.