MacSync macOS infostealer with iCloud calendar payload delivery
Malware Activity
Summary
Hide ▲
Show ▼
MacSync now uses public iCloud calendar events to deliver fresh payloads on macOS, expanding its infection chain and increasing the risk of credential theft and remote control. The malware also adds a new Objective-C backdoor that can run attacker-supplied AppleScript, establish persistence, and upload files to command-and-control infrastructure. Its distribution has included ClickFix-style attacks and fake software lures, including a fake crypto wallet called Toria.
Related Happenings
CloudSyncD macOS backdoor with fake Zoom installer and live C2
Malware Activity
H score24
First: 01.10.2026 16:30
Last: 01.10.2026 16:30
Sources 1
About this happening:
The CloudSyncD macOS backdoor has advanced from development testing to samples configured against live C2 infrastructure, increasing the risk of real-world deployment....
CloudSyncD macOS backdoor with fake Zoom installer and live C2
Malware ActivityAbout this happening: The CloudSyncD macOS backdoor has advanced from development testing to samples configured against live C2 infrastructure, increasing the risk of real-world deployment....
PamStealer macOS stealer adds live C2 decryption and multi-layer persistence
Malware Activity
H score29
First: 25.09.2026 16:18
Last: 25.09.2026 16:18
Sources 1
About this happening:
The PamStealer macOS stealer now uses a server-side decryption chain for its payload, making static recovery impossible without live C2 cooperation. The latest build a...
PamStealer macOS stealer adds live C2 decryption and multi-layer persistence
Malware ActivityAbout this happening: The PamStealer macOS stealer now uses a server-side decryption chain for its payload, making static recovery impossible without live C2 cooperation. The latest build a...
PasteSwitch malicious ClickFix ads campaign via HBO Max Reddit account
Campaign
H score32
First: 21.09.2026 11:39
Last: 21.09.2026 11:39
Sources 1
About this happening:
The PasteSwitch campaign abused HBO Max's official Reddit account (u/hbomax) to push 108 malicious ads over 48 hours, turning a trusted brand channel into a delive...
PasteSwitch malicious ClickFix ads campaign via HBO Max Reddit account
CampaignAbout this happening: The PasteSwitch campaign abused HBO Max's official Reddit account (u/hbomax) to push 108 malicious ads over 48 hours, turning a trusted brand channel into a delive...
PasteSwitch ClickFix malware delivery of MacSync, AMOS helper, and Amatera Stealer
Malware Activity
H score30
First: 14.09.2026 21:34
Last: 14.09.2026 21:34
Sources 1
How related:
MacSync has been distributed to victims through social engineering, including ClickFix-style attacks, and through software presented as free, cracked, or as new applications.
About this happening:
PasteSwitch continues to use ClickFix-style social engineering to push MacSync and related payloads onto Windows and macOS systems, with a prior HBO Max Re...
PasteSwitch ClickFix malware delivery of MacSync, AMOS helper, and Amatera Stealer
Malware ActivityHow related: MacSync has been distributed to victims through social engineering, including ClickFix-style attacks, and through software presented as free, cracked, or as new applications.
About this happening: PasteSwitch continues to use ClickFix-style social engineering to push MacSync and related payloads onto Windows and macOS systems, with a prior HBO Max Re...
Latest development: 24.09.2026 23:53
Kaspersky identified a MacSync campaign targeting macOS that uses public iCloud calendar events to hide commands in the DESCRIPTION: line, fetch a next-stage archive from iCloud, and reach the malware through an APP bundle dropper. The same campaign also adds an Objective-C backdoor that disguises itself as Finder, establishes persistence through LaunchAgent, .zshrc modifications, and global Git hooks, and can run attacker-supplied AppleScript or replace an installed Ledger wallet app.
Fake Codex download campaign using Google Sites and ClickFix
Campaign
H score35
First: 24.08.2026 18:00
Last: 24.08.2026 18:00
Sources 1
About this happening:
The fake Codex download campaign is using sponsored search results, Google Sites lures, and ClickFix instructions to push macOS users into running malware. The...
Fake Codex download campaign using Google Sites and ClickFix
CampaignAbout this happening: The fake Codex download campaign is using sponsored search results, Google Sites lures, and ClickFix instructions to push macOS users into running malware. The...
Timeline
-
24.09.2026 23:53 2 articles · 13d ago
MacSync uses public iCloud calendar events to deliver payloads
Initial DisclosureKaspersky describes a new MacSync variant targeting macOS that uses public iCloud calendar events to fetch fresh payloads, with a downloader reading commands from a calendar event’s DESCRIPTION line, retrieving an archive from iCloud, and unpacking an APP bundle dropper. The campaign also adds an Objective-C backdoor that disguises itself as Finder, persists through LaunchAgent, .zshrc modifications, and global Git hooks, can run attacker-supplied AppleScript, and can replace an installed Ledger wallet app.
Show sources
- MacSync malware uses public iCloud calendars to deliver new payloads — www.bleepingcomputer.com — 24.09.2026 23:53
- MacSync malware uses public iCloud calendars to deliver new payloads — www.bleepingcomputer.com — 24.09.2026 23:53