A new MacSync malware campaign uses public iCloud calendar events as part of its infection chain, according to Kaspersky researchers. Commands hidden in an event description direct a downloader to fetch more malicious components from iCloud.
Calendar Event Hides Download Commands
MacSync targets macOS users through deceptive downloads and social engineering. Researchers have seen it presented as free or cracked software, as well as a fake cryptocurrency wallet called Toria.
Kaspersky identified two delivery methods in a recent campaign. In the more complex method, a downloader retrieves the contents of a public iCloud calendar event and passes that data to the Mac’s zsh shell.
Most of the event text produces errors. However, commands placed after the event’s DESCRIPTION: line run and retrieve an archive from iCloud. The archive contains an app bundle that starts a series of installation stages. Those stages eventually deliver MacSync.
Stealer Targets Credentials and Files
The information-stealing component remains largely similar to earlier versions. It seeks browser history, cookies and saved credentials, along with cryptocurrency wallet data and Telegram files.
It also targets the macOS Keychain file, system details, and files associated with SSH, AWS, Kubernetes and Git. The malware can display its own password prompts to try to obtain further access.
New Backdoor Adds Remote Capabilities
Kaspersky found a new backdoor module written in Objective-C. It disguises itself as Finder and uses several methods to restart after a reboot, including a LaunchAgent and changes to shell configuration.
The installer also terminates macOS notification processes, which could prevent users from seeing alerts. According to the researchers, the backdoor can receive instructions from its control server, collect files and system information, and upload that data.
Some command names suggest it can deploy a browser extension or replace a Ledger wallet app. Kaspersky could not inspect the AppleScript code behind those commands, so it could not confirm precisely how they work. The researchers also found another downloaded component whose purpose remains unknown.
Mac Users Should Check Unexpected Downloads
The calendar-based delivery method gives MacSync malware another way to retrieve its components. Mac users should avoid running commands supplied by websites or unexpected prompts. They should also treat software downloads from unfamiliar sites and requests for an administrator password with caution.
0 responses to “MacSync Malware Uses Public iCloud Calendars to Deliver Payloads”