MacSync info-stealing malware hides malicious commands in an iCloud calendar

A new variant of MacSync malware targets Mac users with an infostealer and persistent backdoor designed to exfiltrate credentials, cryptocurrency wallet data, and files. The malware was found spreading via a crypto wallet application named Toria, which utilized its own website for promotion on X and Telegram. Researchers noted a significant shift in the malware's execution method, moving from AppleScripts to compiled executable files written in Swift and Objective-C, and employing binary droppers and loaders instead of shell scripts.
The infection chain involved delivering malicious commands via a process where a downloader script fed data from an iCloud calendar file into the zsh shell, which processed specific lines following the DESCRIPTION: marker to execute commands that downloaded further stages. The stealer prompts for an administrator password using the Pluggable Authentication Modules (PAM) API, a new technique observed in macOS malware. Data exfiltrated includes browser history, saved logins, crypto wallet extension data, Telegram data, Keychain contents, system information, and configuration files for various systems like SSH, AWS, and Git.
A backdoor disguised as Finder operates through a LaunchAgent named com.apple.finder.agent, relying on commands in .zshrc and Git hooks to maintain persistence. This backdoor communicates with an attacker-controlled server via AppleScript, allowing the attackers to deploy browser extensions, replace wallet applications, and collect further system data.

* A new MacSync variant targets Mac users with an infostealer and persistent backdoor.
* The malware aims to steal credentials, crypto wallet data, and files.
* The infection spread through a crypto wallet app named Toria, which had its own website promoted on X and Telegram.
* Early versions used AppleScripts similar to the AMOS stealer; newer variants use Swift and Objective-C executable files for payloads.
* The latest version was spotted by Kaspersky in September 2026.
* Infection chains utilized binary droppers and loaders instead of obfuscated shell scripts.
* Commands were hidden within calendar events, delivered via a chain involving droppers that unpacked subsequent downloaders from an attacker-controlled server.
* The stealer prompted for the administrator password using the PAM API.
* Stolen data includes browser history, cookies, saved logins/passwords, crypto wallet extension data, Telegram data, Keychain files, and system information (apps, processes, device model).
* Configuration files for SSH, zsh, AWS, Kubernetes, and Git were targeted.
* A backdoor masquerades as Finder and uses a LaunchAgent named com.apple.finder.agent.
* The backdoor executes AppleScript to deploy browser extensions, replace wallet apps, and collect system information.

The shift in execution methodology from native scripting to compiled binaries, coupled with the use of infrastructure components like iCloud calendars for command delivery, reveals an adaptation by threat actors to evade traditional signature-based detection. The reliance on PAM API for password harvesting highlights a pivot toward exploiting deep operating system functionalities rather than relying on simple file access or user input prompts.
The pattern of embedding commands within seemingly benign data—like calendar entries—and then chaining through multi-stage binary loaders suggests an adversarial focus on leveraging legitimate system functions as covert conduits. This complexity moves beyond simple exfiltration; it implies a strategy aimed at achieving deep, persistent control and gathering highly specific intellectual property related to the IT and cryptocurrency sectors.
The fact that the malware specifically targets developers and crypto enthusiasts suggests that the value of the stolen data is extremely high, indicating a targeted threat landscape rather than indiscriminate mass compromise. The resulting backdoor’s function—replacing legitimate applications like Ledger wallets and relaying browser traffic—indicates an objective focused on establishing control over cryptographic assets and communication channels on developer devices.
Bridge Questions: How does this evolution of malware techniques change the defensive priorities for endpoint security in developer environments? What systemic vulnerabilities must be addressed when operating systems are leveraged as command execution pipelines? What is the scope of responsibility when software ecosystems themselves become vectors for persistent compromise?