MacSync malware uses public iCloud calendars to deliver new payloads
MacSync malware uses public iCloud calendars to deliver new macOS payloads.
A new variant of the MacSync info-stealing malware for macOS has been discovered using public iCloud calendar events to deliver its payloads. This malware, which emerged in April 2025, has been observed in ClickFix campaigns and disguised as legitimate tools. It has evolved with new modules, including a backdoor that can execute attacker-supplied scripts and deploy malicious browser extensions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run iCloud Calendar?
Get an email when a new story names iCloud Calendar, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe MacSync malware exploits a legitimate, trusted service — public iCloud calendars — as a command-and-control channel, making malicious activity difficult to distinguish from normal user behavior. It spreads through ClickFix social engineering campaigns where users are tricked into executing malicious scripts disguised as legitimate tools, highlighting a critical gap in user awareness. The malware's modular design, including a backdoor and rogue browser extensions, allows attackers to persist and expand their foothold over time. This matters because abusing trusted cloud platforms bypasses many traditional security controls that rely on blocklisting known-bad infrastructure.
What helps against this
How we list vendors- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.