SecurityBleepingComputerabout 2 hours ago
MacSync Malware Hides Payloads in iCloud Calendars
3 min read
Kaspersky found a new MacSync variant that hides commands in public iCloud calendar event descriptions, feeding them to macOS's zsh shell to fetch malware. The Swift-based infostealer, first seen in April 2025, now adds an Objective-C backdoor posing as Finder, with persistence via LaunchAgent and Git hooks. It steals credentials, cookies, crypto wallets and Keychain data.
Level
Hype check
Tap to vote and see what everyone thinks.
