MacSync Malware Hides in iCloud Calendars

Kaspersky found a new MacSync variant that hides commands in public iCloud calendar event descriptions, feeding them to macOS's zsh shell to fetch malware. The Swift-based infostealer, first seen in April 2025, now adds an Objective-C backdoor posing as Finder, with persistence via LaunchAgent and Git hooks. It steals credentials, cookies, crypto wallets and Keychain data.