Malicious Ad for Homebrew Leads to MacSync Stealer, Author: Brad Duncan

Un malware macOS peut détourner iCloud Calendar pour récupérer des commandes hébergées sur un service Apple légitime. En septembre 2026, Kaspersky a observé MacSync lire un calendrier public, transmettre son contenu à l’interpréteur zsh, puis télécharger et exécuter une charge malveillante. Il ne s’agit pas d’une faille d’iCloud Calendar, mais d’un abus de confiance destiné à dissimuler le canal de commande.

MacSync malware hides malicious commands inside iCloud calendar events to download additional payloads onto infected Macs without raising suspicion.

MacSync malware hides malicious commands inside iCloud calendar events to download additional payloads onto infected Macs without raising suspicion.

MacSync malware hides malicious commands inside iCloud calendar events to download additional payloads onto infected Macs without raising suspicion.

Read more

Analizamos la nueva versión de MacSync, el stealer para macOS, con un módulo de puerta trasera dirigida a los entusiastas de las criptomonedas y a los desarrolladores.

Groups Conversations All groups and messages Sign in Technical - Malware Conversations About Privacy • Terms     MacSync under the microscope: new delivery methods and a new payload 0 views Skip to first unread message Eyal Estrin unread, 9:32 AM (12 minutes ago)    to https://securelist.com/macsync-new-version/121383/ Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

At a Glance Attribute Details Malware Family MacSync (originally advertised as Mac.c) Threat Actor Unknown cybercriminals (Malware-as-a-Service model; unconfirmed attribution) Target Victims Cryptocurrency investors, software developers, and macOS administrators Delivery Vector Malicious disk images (DMGs), fake crypto apps, and public iCloud calendars Key Capabilities Curve25519 key exchange, PAM credential validation, multi-layer persistence, data exfiltration Source Kaspersky Threat Intelligence (Securelist) Executive Summary…

Today's news highlights a more pressing issue than others: the rise of cyber threats targeting everyday users and widely used devices. Two distinct cases, on macOS and Android, demonstrate how malware is leveraging increasingly credible channels to…

Cybersecurity researchers at Kaspersky have uncovered a sophisticated and heavily updated variant of MacSync, a notorious macOS infostealer that first emerged between 2024 and 2025 as a derivative of the AMOS malware family. Spotted in the wild in September 2026, this upgraded version features a far more complex infection chain designed to silently deploy both […] The post Kaspersky Warns of Sophisticated MacSync Malware Upgrade Targeting macOS Users & Crypto Assets appeared first on The Filipino Tech Explainer.

Nel flusso di notizie di oggi emerge con chiarezza un tema più solido degli altri: la crescita delle minacce informatiche rivolte a utenti comuni e dispositivi diffusi. Due casi distinti, su macOS e Android, mostrano come i malware stiano sfruttando…

We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.

We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.

Kaspersky researchers found a new MacSync variant using a fake crypto wallet app, executable payloads and an iCloud calendar handoff to steal Mac credentials, wallet data and files.

A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads. The malware leverages this technique as a command and control mechanism to distribute malicious code to infected systems.