MalwarePublished 24 Sep 2026

MacSync malware uses public iCloud calendars to deliver new payloads

Source Bleeping Computer

Description

A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads. [...]

Impact

The malware can steal a wide range of sensitive data including browser credentials, crypto wallet information, Telegram data, and system files. The backdoor module allows remote execution of commands, deployment of malicious extensions or apps, data exfiltration, and persistence on infected macOS systems. It also suppresses user notifications to avoid detection. These capabilities enable attackers to maintain long-term access and control over compromised systems, potentially leading to significant data breaches and unauthorized access to user accounts and assets.

Defensive guidance

Users should avoid executing commands found online, refrain from downloading DMG files from untrusted or suspicious sources, and treat admin password prompts with caution. Employing endpoint protection solutions capable of detecting MacSync and related malware variants is recommended. Monitoring for unusual persistence mechanisms such as LaunchAgents, .zshrc modifications, and unexpected Git hooks may help identify infections. Users should also be cautious about social engineering campaigns promoting fake crypto wallets or cracked software.

References

bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Sep 2026, 21:03 UTC

References

Community reviews

Related threats