MacSync Weaponizes iCloud Calendar: Public Calendars Become C2 Dead Drops

On September 24, 2026, a Kaspersky SecureList technical report documents a new MacSync malware variant that abuses public iCloud calendars to conceal malicious commands in the DESCRIPTION field. The mechanism exploits Apple's trust reputation: enterprise filters that allow traffic to caldav.icloud.com do not inspect the textual content of public calendars, turning a legitimate productivity service into command-and-control infrastructure.

From AMOS Stealer to MaaS: The Evolution of the MacSync Family

MacSync derives from the AMOS stealer family and emerged in April 2025 as Swift-based malware. The new variant documented by Kaspersky in September 2026 represents a significant architectural shift. According to the primary technical report, "the developers of this family have overhauled their approach to payload delivery by replacing script-based droppers with binary ones." The move to binary droppers complicates static analysis and reduces visibility for security tools that rely on script scanning.

The malware operates as a service (MaaS, malware-as-a-service), with operators independently selecting the initial delivery method. This modularity explains the variety of observed vectors: from a specific campaign using the fake 'Toria' crypto wallet promoted on X and Telegram, to ClickFix techniques documented in earlier stages. The fragmentation of the initial vector makes defense based solely on blocking known domains or indicators of compromise impractical.

The iCloud Calendar Mechanism: Steganography Applied to the .ics Format

The innovative core of the variant lies in the abuse of the public iCalendar (.ics) format. The downloader retrieves the file from a specific URL on caldav.icloud.com: the observed path is hxxp://caldav.icloud[.]com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08. The execution flow is technically precise: the malware creates an anonymous pipe, launches zsh -s, and redirects the calendar content line by line. Only lines following the DESCRIPTION: field are interpreted as shell commands.

The extracted commands download a .TAR.GZ archive from iCloud, which contains a dropper .APP bundle. This removes the quarantine attribute with xattr -cr, applies an ad-hoc signature, and executes the next payload. The choice of iCloud as host for the archived payload is functional: the domain enjoys maximum reputation in enterprise filtering systems, and HTTPS traffic to iCloud is not subjected to deep inspection in most organizations.

Multi-Stage Encryption and Anti-Analysis: The Payload's Countermeasures

The dropper implements a multi-stage decryption chain. It uses AES keys in CBC mode with stage-specific IVs, with the magic word SONOMAC1 as a marker for recognizing the encrypted overlay, read backwards from the binary file. This structure prevents direct extraction of the final payload without replicating the exact decryption logic.

The second dropper includes anti-debugging and anti-VM checks that halt execution in analysis environments. It verifies the kern.hv_vmm_present and machdep.cpu.brand_string parameters via sysctl, and sets the PT_DENY_ATTACH flag via ptrace. The combination of these techniques indicates a design aimed at survival in enterprise macOS environments, where virtual machines are common analysis and development tools.

"Threat actors are actively refining their social engineering tactics to serve as the initial entry point into victim devices" — Puzan, Kaspersky

The Objective-C Backdoor: Persistence and Post-Exploitation Capabilities

The final payload is an Objective-C backdoor that masquerades as Finder. Persistence is implemented on three simultaneous fronts: a system-registered LaunchAgent, modification of the user's .zshrc file, and insertion of global Git hooks. This redundancy ensures survival even after partial removal of a single mechanism.

The backdoor terminates macOS notification processes, reducing visibility of malicious actions to the user. Documented capabilities include: execution of AppleScript received from the C2 server, deployment of malicious browser extensions, replacement of the Ledger wallet application with a counterfeit version, and exfiltration of system data. Exfiltration uses chunks of changed size compared to previous versions: approximately 90 megabytes per upload, with temporary files created in /tmp/.sys-<random 16-digit value>.

The backdoor module uses the pkgunpack utility with ECDH Curve25519 for key exchange with the C2 server, confirming the adoption of modern cryptography to protect communications from signature-based detection.

What to Do Now

• Monitor network traffic to caldav.icloud.com and icloud.com from unauthorized processes: the calendar download mechanism is the most detectable phase of the chain
• Inspect modifications to .zshrc, LaunchAgents in ~/Library/LaunchAgents, and global Git hooks: the backdoor's multi-layered persistence requires checks on all three vectors
• Verify the presence of processes named "Finder" with anomalous executable paths: the backdoor masquerades with the legitimate macOS process name
• Treat any administrator password request from unverified applications with suspicion, even if accompanied by apparently legitimate context such as a crypto wallet download

Why This Technique Redefines the Threat Perimeter

The abuse of public iCloud calendars does not exploit a vulnerability in Apple's service: it exploits a by-design characteristic, the absence of semantic inspection of textual content in legitimate productivity formats. This shifts the problem from technical vulnerability to security policy: domain-reputation-based filters, still predominant in enterprise architectures, are ineffective against payloads hosted on trusted cloud infrastructure.

The public calendar functions as an asynchronous dead drop: the operator can update commands in the DESCRIPTION field without directly interacting with the compromised machine, and the malware retrieves instructions according to its own polling logic. This temporal separation between command delivery and execution complicates event correlation in detection and response platforms.

The brief does not specify the exact content of scripts distributed by the attacker's server beyond those present in the iCloud calendar: hypothesized identical but not independently verified. The dossier also does not document the exact number of victims or affected geographic entities, nor the identity of specific MaaS operators beyond the generic group associated with the MacSync family.

Sources

• https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/
• https://daily.dev/posts/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads-wo0xysmdq
• https://blog.netmanageit.com/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/
• https://radar.offseq.com/threat/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads-b0e0f4b273061fb9
• https://streamlinefeed.co.ke/news/kaspersky-uncovers-complex-new-macsync-malware-variant-targeting-macos-users
• https://securelist.com/macsync-new-version/121383/
• https://www.bleepingcomputer.com/
• https://www.bleepingcomputer.com/tutorials/
• https://www.bleepingcomputer.com/download/
• https://deals.bleepingcomputer.com/
• https://www.bleepingcomputer.com/vpn/

Information has been verified against cited sources and updated at time of publication.

Sources