MacSync malware uses public iCloud calendars to deliver new payloads
-
A new variant of the MacSync malware targeting macOS systems has been observed using public iCloud calendar events as a delivery mechanism for fresh native payloads. Rather than relying solely on hardcoded command-and-control infrastructure, the updated sample retrieves instructions and payload references from publicly accessible calendar entries, a technique that makes the malware's traffic blend in with legitimate Apple service activity and complicates takedown efforts.
Key points from the report:
- The malware targets macOS hosts and delivers new native payloads rather than script-based ones.
- Payload delivery is coordinated through public iCloud calendar events, allowing the operators to update the malware's behavior without recompiling or re-hosting binaries.
- Because the calendar data is hosted on Apple's infrastructure, blocking the delivery channel is more difficult for defenders relying on domain or IP-based filtering.
Defenders tracking MacSync should treat iCloud calendar traffic with suspicion where it correlates with abnormal process execution or persistence activity, and review endpoint telemetry for unusual child processes spawned by applications that sync calendar data.
Source: Unknown
Has anyone seen MacSync indicators in their environment, and how are you handling the iCloud calendar delivery vector?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login