Mac users are facing a new kind of sneaky threat that hides in plain sight, with attackers using a public iCloud calendar event as part of a malware chain. The campaign centers on MacSync, a data-stealing threat that can pull passwords, browser data, crypto wallet details and other sensitive files from an infected machine.
Security researchers say the calendar itself is not the entry point, but it is being used as a hiding place for malicious commands after a user has already been tricked into running harmful software. That makes the attack feel especially underhanded, because it borrows trust from familiar Apple services while pushing users toward fake apps, bogus fixes and other common lures.
MacSync is not new, but it has grown sharper and more flexible over time. Researchers trace it back to a dark web malware family that has been sold in a malware-as-a-service model, letting different criminals package and deliver it in whatever way works best for them.
That delivery can take a lot of forms. Fake software, cracked apps, convincing utilities and “helpful” commands copied into Terminal have all been used to spread it, and the latest twist shows how creative attackers have become when they want a way around simple suspicion.
In one infection chain, a downloader reached out to a public iCloud calendar and pulled commands buried inside the event description. Those instructions were then fed into the Mac’s command shell, where the malicious parts could finally kick in and download more malware from iCloud.
Most of the calendar text is harmless noise to the system, but the hidden instructions at the right point in the event can slip through and trigger the next stage. Researchers say this does not mean opening Calendar makes a Mac vulnerable by itself, yet it does show how attackers can dress up a malicious chain with services that look normal and even trustworthy.
The malware is also being used alongside a fake cryptocurrency wallet called Toria. The scammers built a dedicated website for the fake product and pushed it through X and Telegram, which is a reminder that a polished landing page can still hide a rotten core.
Once MacSync is on a machine, it goes after a broad mix of valuable data. That includes browser history, cookies, saved logins, passwords, crypto wallet extension data, Telegram information, Keychain data and system details such as installed apps, running processes and hardware information.
For more technical users, the list gets even messier. The malware also hunts through configuration files and command histories tied to SSH, Zsh, AWS, Kubernetes and Git, which gives thieves a chance to pry into both personal accounts and work systems if they get lucky.
Researchers also uncovered a separate backdoor component that pretends to be Finder, the built-in Mac file manager. It tries to stick around after a reboot by using common persistence tricks, including LaunchAgents, shell startup file changes and global Git hooks.
That same backdoor can also shut down notification processes, which helps keep the user from noticing that something new has been planted on the system. From there, attackers can push commands to the infected Mac and potentially add browser extensions, swap out wallet apps or grab more files and system data.
One command tied to the backdoor, called live_browser, remains unclear in exact purpose. Researchers suspect it may be aimed at intercepting browser traffic in some way, but the full picture is still evolving as more samples surface.
What makes this kind of threat so effective is not magic, but routine. Mac users are often trained to trust familiar prompts and recognizable services, and attackers keep exploiting that habit with fake fixes, bogus warnings and password requests that feel ordinary at first glance.
Apple says macOS includes layers like Gatekeeper, XProtect and notarization to help stop known malware and risky downloads. Recent versions also add protections for pasted Terminal commands and scripts, which is a direct response to scams that push users to do the attacker’s work for them.
Even so, the biggest defense is still a skeptical eye. A website that wants a pasted command, a random app asking for an administrator password, or an unfamiliar download pushed through social media should all raise eyebrows fast, because these attacks depend on users giving away the opening they need.
Good habits matter here more than flashy promises. Download software only from trusted sources, keep macOS updated, review browser extensions, protect important accounts with two-factor authentication and change passwords quickly if anything feels off, because once a stealer has your data, the damage can spread fast.
MacSync is a sharp reminder that attackers do not always need to break down the door when they can trick someone into opening it. A calendar event, a fake app or a polished crypto site may look harmless at first, but that is exactly the kind of disguise modern malware is counting on.
