Sonoma: The Mac Malware Turning iCloud CalDAV Into a Criminal CDN

The Crazy Evil cybercrime group has deployed a new macOS malware family dubbed Sonoma, discovered by researchers at Moonlock Lab, MacPaw's security division. The malware, internally tagged as SONOMAC1 and _sonomab_, masquerades as legitimate collaboration and video-conferencing apps to steal passwords, keychain data, cryptocurrency wallets, and development secrets. The technical analysis published on September 21, 2026 reveals a troubling novelty: abuse of iCloud's CalDAV protocol as staging infrastructure, exploiting the implicit trust enterprise filters place in Apple domains.

Infection Chain: From Zoom to iCloud

The campaign relies on a multi-stage chain that begins with DMG or ZIP lures. At least 11 brands have been impersonated: StreamYard, Zoom, Brave Talk, Toria, Waaako, Meendo, CavePay, Crystal Flip, Cốc Cốc, Slack, and DocSend. The list is not exhaustive, according to Moonlock. The user downloads what they believe is a legitimate installer, but the package contains a universal Mach-O launcher.

The launcher performs two key operations in sequence: it removes Gatekeeper quarantine attributes with xattr -dr and xattr -cr, then launches a shell script via zsh -s in a pipe rather than writing an executable to disk. This approach, documented in the sandboxed process tree analyzed by Moonlock, reduces the detection surface for file-system-based security solutions.

The staging phase is where Sonoma innovates relative to previous macOS infostealers. Instead of relying solely on attacker-controlled domains, the malware downloads additional payloads from URLs hosted on gateway.icloud.com/caldav/.... The TLS certificate is Apple's legitimate one: enterprise web filters that block suspicious domains allow traffic to *.icloud.com to avoid breaking calendar sync. According to Moonlock, operators use disposable iCloud accounts, making the vector resilient to traditional takedowns.

In-Process PAM: Password Theft Without Child Processes

Once executing, the Swift core stealer must overcome the macOS login keychain, protected by the user's password. Instead of spawning child processes like security unlock-keychain or osasc — moves typically monitored by EDR — Sonoma dynamically loads libpam.2.dylib and calls pam_authenticate within its own process space.

The technique presents the user with an AppKit dialog labeled MacClient.SystemInputShell, which shakes on incorrect password entry, mimicking OS feedback. After verification, the malware unlocks the keychain with security unlock-keychain and exports sensitive data via SecItemCopyMatching. Moonlock emphasizes this "PAM shift" is a deliberate anti-detection improvement: fewer suspicious shell processes, same practical result for the attacker.

Targeted data includes: browser information, cryptocurrency wallets (MetaMask, Phantom, Coinbase, Ledger Live, Trezor, Exodus, Electrum, and others), development secrets in ~/.aws, ~/.kube, ~/.ssh, git configurations and shell history, plus system profiling.

From AMOS to Sonoma: The Evolution of Crazy Evil's MaaS

Moonlock positions Sonoma as the next chapter, not a recycle, of the criminal history that began with AMOS (Atomic MacOS Stealer). Roughly two years after the AMOS/Loom campaign of August 2024, the Crazy Evil group has built a custom pipeline with dedicated builder and payloads. Researchers found an indicative path in the "One Crystal Flip" launcher build artifacts: /var/www/evilcorp/backend/templates/macos/launcher.c, suggesting a centralized MaaS (Malware-as-a-Service) panel for variant generation.

The persona behind the macOS tooling appears as "ev1lc0rp." Recorded Future has profiled Crazy Evil as a "traffer-style" operation with specialized subteams — ZOOMLAND, DEFI, AVLAND, KEVLAND, DELAND, TYPED — targeting crypto, Web3, and collaboration software sectors. The continuity of modus operandi between AMOS/Loom and Sonoma confirms the group's specialization on the Apple platform, though Moonlock does not rule out operator or infrastructure sharing without asserting direct continuity.

"Enterprise filters routinely trust *.icloud.com, and the TLS certificate is Apple's – blocking it breaks real calendar sync. Disposable iCloud accounts thus become a resilient staging CDN." — Moonlock Lab

Campaign Geography and Visibility Limits

Moonlock telemetry, based on the MacPaw, CleanMyMac, and Moonlock install base, has detected Sonoma activity in Spain and Japan, indicating an active campaign. However, the dossier does not specify the true geographic scope: data is limited to the security suite's user base and does not necessarily represent the global infection landscape. The exact number of confirmed victims is not available.

Several elements remain undocumented: it is unclear whether Sonoma has a CVE designation or has been officially reported to Apple; it is unconfirmed whether Apple has taken specific countermeasures against CalDAV abuse from disposable accounts; the exact relationship between Sonoma and previous AMOS families remains partially opaque despite Moonlock's assertion of no direct derivation.

What to Do Now

For Mac users in the crypto and Web3 sectors, the risk of installing malware disguised as collaboration apps is high and growing. The Sonoma campaign impersonates at least 11 known brands, with Zoom, Brave Talk, StreamYard, and Slack among the most prominent. Verifying the origin of every downloaded DMG or ZIP — even from seemingly official links — is the first case-specific action.

For enterprises, the challenge shifts to more granular endpoint controls capable of distinguishing legitimate CalDAV use from executable payload downloads. Traditional web filters, designed to block known malicious domains, become inadequate when attackers migrate to legitimate cloud infrastructure with implicit trust. The iCloud CalDAV abuse exploits no Apple vulnerability, but an architectural characteristic: the need to keep traffic to *.icloud.com open to preserve business functionality.

For threat intelligence, Sonoma confirms the evolution of macOS stealers toward anti-EDR and living-off-the-cloud techniques requiring continuous defense adaptation. The C2 server 109[.]94[.]171[.]225:443 (Greencloud LLC) and disposable iCloud CalDAV domains represent specific operational indicators to monitor.

The source does not specify specific remedial measures by Apple nor detailed operational recommendations for end users. The dossier also does not document whether additional indicators of compromise exist beyond those published, nor does it provide a remediation timeline.

Frequently Asked Questions

Is Sonoma linked to the fake Zoom campaign reported by Techlicious?
No. Techlicious described in August 2026 a campaign dubbed SMOKE#SCREEN using ConnectWise ScreenConnect, tracked by Securonix. Sonoma is technically distinct malware with different TTPs, though both exploit Zoom impersonation as an initial vector.

Why the name Sonoma?
According to Moonlock, the name derives from the internal marker SONOMAC1 found in the Mach-O __const section, not from Apple's macOS Sonoma operating system.

Are passwords stolen via a zero-day exploit?
No. Password collection occurs through social phishing with a spoofed dialog, not through a technical exploit of the operating system.

Information is based on the cited source and current as of publication.

Sources

• https://hackernoon.com/downloading-zoom-or-brave-could-be-new-mac-malware-sonoma-in-disguise
• https://www.techlicious.com/blog/fake-zoom-update-malware-now-targets-mac/
• https://moonlock.com/loom-macos-stealer?ref=hackernoon.com
• https://www.recordedfuture.com/research/crazy-evil-cryptoscam-gang?ref=hackernoon.com