<![CDATA[MacSync malware uses public iCloud calendars to deliver new payloads]]>A new variant of the MacSync malware targeting macOS systems has been observed using public iCloud calendar events as a delivery mechanism for fresh native payloads. Rather than relying solely on hardcoded command-and-control infrastructure, the updated sample retrieves instructions and payload references from publicly accessible calendar entries, a technique that makes the malware's traffic blend in with legitimate Apple service activity and complicates takedown efforts.

Key points from the report:

  • The malware targets macOS hosts and delivers new native payloads rather than script-based ones.
  • Payload delivery is coordinated through public iCloud calendar events, allowing the operators to update the malware's behavior without recompiling or re-hosting binaries.
  • Because the calendar data is hosted on Apple's infrastructure, blocking the delivery channel is more difficult for defenders relying on domain or IP-based filtering.

Defenders tracking MacSync should treat iCloud calendar traffic with suspicion where it correlates with abnormal process execution or persistence activity, and review endpoint telemetry for unusual child processes spawned by applications that sync calendar data.

Source: Unknown

Has anyone seen MacSync indicators in their environment, and how are you handling the iCloud calendar delivery vector?

]]>https://xploitlk.com/topic/454/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloadsRSS for NodeTue, 27 Oct 2026 08:16:02 GMTThu, 24 Sep 2026 22:30:17 GMT60