MacSync Malware Uses iCloud Calendar Commands to Steal Data from Mac Users
Summary
Kaspersky details a MacSync campaign distributed through a fake crypto wallet app. The malware uses multi-stage loaders, steals credentials and other data, and installs a persistent backdoor disguised as Finder.
Key points
- The campaign spread through the fake Toria crypto wallet app, promoted on X and Telegram.
- One infection chain used commands hidden after the DESCRIPTION: line in a public iCloud calendar event.
- The stealer targets browser data, passwords, Keychain contents, crypto wallets, Telegram data, developer configurations, and command history.
- It uses a deceptive administrator-password prompt and the PAM API to verify passwords.
- An Objective-C backdoor masquerades as Finder and persists through a LaunchAgent, shell configuration, and Git hooks.
- Kaspersky says the backdoor can run attacker-supplied AppleScript commands; researchers could not determine what the downloaded sn_relay file does.
Article Details
- Attack Vectors
- The campaign distributed the fake crypto wallet app Toria through its own website and promotion on X and Telegram.
- A DMG contained a compiled JXA script that decoded a shell script and passed it directly to the interpreter.
- In another delivery chain, an app in the DMG removed its quarantine attribute, decrypted a link to a downloader script, and launched successive droppers and loaders.
- At least one downloader obtained commands from a public iCloud calendar; the commands after the DESCRIPTION: line downloaded an archive containing another app.
- The stealer displayed a fake administrator-password prompt and a false system notice that the app was damaged.
- The backdoor persisted through a LaunchAgent, a command added to .zshrc, and commands added to global Git hooks.
- The backdoor ran AppleScript commands supplied by the attackers’ server, including commands to deploy a browser extension, replace the installed Ledger wallet app, collect data, and download and run a file named sn_relay.
- Defensive Notes
- Treat unexpected administrator-password prompts from apps with caution; the reported stealer used a deceptive prompt to collect credentials.
- Review unfamiliar LaunchAgents, changes to .zshrc and global Git hooks, and unexpected restoration scripts or processes that suppress macOS notifications.
- Investigate suspicious DMG-delivered apps, droppers, loaders, and scripts that retrieve commands from calendar content or remote servers.
- Assess potential exposure of browser data, Keychain data, crypto wallet files, Telegram data, developer configuration files, shell history, and device credentials.
MITRE ATT&CK
T1059.002 · AppleScriptThe backdoor runs AppleScript commands supplied by the attackers’ server.T1059.004 · Unix ShellA downloader feeds calendar-file lines to zsh, and the delivery chain also uses shell scripts.T1082 · System Information DiscoveryThe malware collects system information, including installed apps, running processes, and device model.T1105 · Ingress Tool TransferThe droppers and loaders download successive scripts, archives, and files from remote sources.T1497.001 · System ChecksA second-stage dropper checks whether it is running in a virtual machine.T1539 · Steal Web Session CookieThe stealer collects browser cookies and saved login data.T1543.001 · Launch AgentThe backdoor restarts through a LaunchAgent named com.apple.finder.agent.T1546.004 · Unix Shell Configuration ModificationThe backdoor adds a command to .zshrc to support persistence.T1555.001 · KeychainThe stealer collects the victim’s Keychain file.T1622 · Debugger EvasionA second-stage dropper blocks debuggers from attaching.
People
Malware
Products
Ledger#MacSyncmacOS“Interestingly, instead of the method most macOS malware families use to verify a password, the dscl utility, the attackers used the Pluggable Authentication Modules (PAM) API.ToriaThe campaign spreads through a fake crypto wallet app called Toria and uses advanced infection chains, disguised prompts, and a backdoor posing as Finder to target developers and crypto enthusiasts.