On September 24, 2026, BleepingComputer reported that MacSync, a macOS info-stealer, abuses public iCloud Calendar events. It uses them to send new commands and payloads to Macs it has already infected. The report builds on a technical writeup from Kaspersky’s Securelist.
If that headline made you eye your Calendar app nervously, take a breath. The attack starts with a malicious DMG file you have to open yourself. Nothing in either report shows that viewing or subscribing to a public calendar can infect your Mac.
What Happened
MacSync is an “info-stealer.” That’s malware built to grab passwords, browser data, and other valuable files from your Mac and send them to an attacker. Two sources describe how it works:
- BleepingComputer (September 24, 2026) covered the new iCloud Calendar delivery trick.
- Kaspersky Securelist published the companion technical analysis of a newer MacSync version.
Kaspersky says MacSync reaches victims through social engineering, including ClickFix-style lures and apps posing as free, cracked, or new software. One campaign disguised it as a fake crypto wallet called Toria, promoted on social media.
The reported infection chain
Both reports describe the same sequence:
- You open a malicious DMG. A DMG is a disk image. Legitimate Mac apps use the same file type for downloads. This is the starting point, and nothing happens until a victim runs it.
- A downloader runs. A component inside the DMG fetches a web address. In at least one analyzed sample, that address pointed to a public calendar on Apple’s
caldav.icloud.comservice. CalDAV is the standard protocol calendar apps use to sync events. - The calendar feeds a shell. The downloader opens
zsh, the Mac’s built-in command-line shell. It streams the calendar’s event data into it. Then it runs commands the attacker hid after the event’sDESCRIPTIONfield. - The payload downloads. Those commands pull down a compressed
tar.gzarchive with a malicious.appbundle inside. The infection continues from there.
Why a calendar? Traffic to an Apple-owned domain looks ordinary. The attacker can also edit the event to push new instructions, with no servers of their own to run.
What’s new in this version
Kaspersky reports that newer MacSync samples have moved on from simple shell-script droppers. (A “dropper” is the piece of malware that installs the rest.) The newer samples use:
- Compiled binary droppers and payload components written in Swift and Objective-C. These can be harder to detect and analyze.
- A backdoor disguised as the Finder app. In the samples Kaspersky analyzed, it set itself up to relaunch automatically (through a LaunchAgent and shell startup files), keeping the attacker’s access to the infected Mac.
What MacSync tries to steal
According to Kaspersky’s analysis of the samples it examined, MacSync goes after:
- Browser-stored data and saved login credentials
- macOS Keychain contents (Apple’s built-in password vault)
- Cryptocurrency wallet files
- Telegram data
- SSH and AWS configuration files
- Shell command history and basic system details
That list leans toward developers and people who hold crypto. Still, any Mac with saved browser passwords is worth an attacker’s time.
Has Apple responded?
Not that we could find. As of September 25, 2026, we found no MacSync advisory on Apple Newsroom or Apple Support, and none of the coverage we reviewed quotes an Apple statement or mentions a patch or a change to iCloud Calendar. We’ll update this story if that changes.
Who This Affects
Mac users are the only confirmed targets. The reports describe a macOS-specific chain built on DMG files, zsh, and .app bundles.
iPhone and iPad users aren’t named as targets in either report. iOS and iPadOS don’t run DMG files, and the chain depends on one.
iCloud Calendar itself works as designed. The reports don’t describe a bug in the Calendar app. Attackers use a legitimate public-calendar feature as a place to stash commands.
How It Stacks Up
For news stories, we usually compare Apple with the Android equivalent (Google Pixel, Samsung Galaxy), the Windows equivalent, and the previous Apple version. That comparison doesn’t work here. Neither report compares MacSync to an Android or Windows threat. Neither gives detection-rate numbers or a before-and-after look at an earlier macOS release.
So here’s what’s verified and what’s missing:
| Question | What the sources show | Source |
|---|---|---|
| Is MacSync a macOS info-stealer? | Yes | BleepingComputer, Kaspersky Securelist |
| Does it abuse public iCloud calendars? | Yes, as a command/payload relay in at least one analyzed sample | BleepingComputer, Kaspersky Securelist |
| Does it need a malicious DMG to run first? | Yes, that’s the documented starting point | BleepingComputer, Kaspersky Securelist |
| Can viewing/subscribing to a calendar infect you? | Not shown in available reporting | BleepingComputer, Kaspersky Securelist |
| Newer variants use Swift/Objective-C droppers? | Yes | Kaspersky Securelist |
| Finder-masquerading backdoor? | Yes, in some newer variants | Kaspersky Securelist |
| Apple advisory or patch? | None found in our search as of September 25, 2026 | Apple Newsroom, Apple Support (no matching entry found) |
| Verified Android or Windows equivalent? | None in the sources | N/A |
| Comparison with earlier macOS versions? | None in the sources | N/A |
One fair general point: attackers on every platform hide traffic inside trusted cloud services. We just don’t have a sourced, like-for-like example for this table.
The Reaction
So far, the story has mostly been passed along rather than argued about. Security outlets such as Help Net Security repeated the researchers’ findings: the iCloud Calendar trick, the shift to Swift/Objective-C binaries, and the Finder-disguised backdoor. We found no competing take on the research.
On Hacker News, the story was submitted with a link to BleepingComputer but had no comments when we checked. Nobody we found calls the story overblown or underplayed. That fits a report that’s mostly technical detail.
What to Do Next
Apple and the researchers haven’t released a MacSync-specific fix. The steps below are general good practice aimed at the documented entry point. If you think your Mac is already infected, contact a professional or your company’s IT team. Don’t improvise a cleanup.
On your Mac (macOS)
The single most useful habit: only open DMG files and installers from sources you trust. That means the Mac App Store or the developer’s official website. Skip links from emails, chat messages, pop-ups, and “cracked” app sites.
It also helps to check that Gatekeeper is doing its job. Gatekeeper is macOS’s built-in check that apps from outside the App Store come from an identified developer and have been notarized by Apple. On a work or school Mac, your IT team may manage this setting for you.
- Open System Settings > Privacy & Security.
- Scroll to the Security section.
- Under Allow applications from, choose App Store for the strictest setting. You can also choose App Store & Known Developers. That still blocks unverified apps but allows signed software from outside the store.
The trade-off: App Store only is safest, but lots of legitimate Mac apps are sold outside the store. For everyday use, App Store & Known Developers is a sensible middle ground. The real risk is overriding the warning. On recent macOS versions, bypassing Gatekeeper means clicking Open Anyway in Privacy & Security. If an installer walks you through that, stop and ask why.
Also keep macOS current via System Settings > General > Software Update. Apple ships background malware-definition updates (XProtect) this way. No update targets MacSync specifically, though.
A few habits also limit what info-stealers can take:
- Store passwords in a dedicated password manager or Apple’s Passwords app, and don’t reuse them.
- Protect your most important accounts with a hardware security key such as a YubiKey. Stolen passwords are much less useful then.
- Keep regular Time Machine backups on an external SSD. Then you can restore a clean system if you ever need to.
On your iPhone or iPad (iOS/iPadOS)
Nothing in the reports says iPhones or iPads are affected. You don’t need to change anything because of this story. Want to tidy up calendars you don’t recognize anyway? Open the Calendar app and tap Calendars. Tap the info button next to any calendar you don’t remember adding, then tap Unsubscribe (or Delete Calendar) and confirm.
This is general housekeeping. The reports don’t show that a subscribed calendar can infect an iPhone.
On the web (iCloud.com)
If you share calendars from iCloud, it helps to know how public calendars work. A public calendar gives anyone with the link read-only access. MacSync’s authors reportedly abused that feature by creating their own public calendars. Apple explains the sharing options, including Public Calendar, in its guide to sharing a calendar on iCloud.com.
To review your own shared calendars, sign in at icloud.com/calendar and open the sharing options for each calendar in the sidebar. If a calendar doesn’t need to be public, turn off Public Calendar. This protects your schedule’s privacy. It won’t stop MacSync, which uses calendars the attacker controls.
Our Take
Verdict: A clever abuse of Apple’s infrastructure. Your calendar has no flaw, and there’s no need to panic or upgrade.
Did Apple handle this better or worse than the competition? That question doesn’t quite fit. Apple didn’t launch a feature or patch a bug here. Malware authors borrowed a trusted Apple service to hide their traffic. No source offers an Android or Windows comparison, so we can’t rank Apple.
We can judge where Apple stands today. As of September 25, 2026, we found no public statement from Apple. That’s common for malware that relies on users running a bad installer. Still, a short note saying public calendars can’t infect you would calm readers. Headlines like “malware uses iCloud Calendar” invite exactly that fear.
Should you upgrade? Keep macOS updated out of habit, but there’s no MacSync patch to chase. The change that matters is how you install apps. MacSync needs you to open a malicious DMG, and the attack falls apart if you never do.
Wrapping Up
MacSync is a real, evolving Mac info-stealer, and its iCloud Calendar trick is sneaky. But it only matters after you’ve already run a bad installer. Nothing shows your subscribed calendars on Mac, iPhone, or iPad are a way in. Stick to the App Store and developers you trust, and you’ve closed the door this attack walks through.
| Step | Action | Applies To |
|---|---|---|
| 1 | Open DMGs and installers only from trusted sources | Mac |
| 2 | Check Privacy & Security > Allow applications from | Mac |
| 3 | Keep macOS updated via General > Software Update | Mac |
| 4 | Review calendars under Calendar > Calendars (optional housekeeping) | iPhone, iPad |
| 5 | Turn off Public Calendar on calendars you don’t need shared | iCloud.com |
This story sounds scarier than it is for everyday Mac users. It’s still a good reminder that “it’s a DMG, so it’s probably fine” is exactly the assumption attackers count on.