MacSync under the microscope: new delivery methods and a new payload

Immediate Actions

Key Takeaways

• Malware evolved from AppleScripts to compiled binaries in Objective-C and Swift.
• Uses iCloud calendar descriptions to deliver shell scripts via zsh pipes.
• Implements ECDH Curve25519 key exchange for decrypting payload modules via custom pkgunpack utility.
• Backdoor persists via LaunchAgent, .ZSHRC injection, and Git hooks, killing notification agents.
• Infostealer uses PAM API for password verification, a newer technique for macOS malware.
• Targets browser data, crypto wallets, Telegram, Keychain, and developer configs (SSH, AWS, K8s, GIT).

Attack Chain

1. Initial Access: Malicious DMG distributed via fake apps (Toria) or ClickFix social engineering
2. Execution: DMG app removes quarantine attributes, decrypts overlay URL pointing to iCloud calendar
3. Execution: iCloud calendar content piped to zsh, downloading and executing Loader.app.tar.gz
4. Defense Evasion: Multi-stage droppers use AES-CBC and ECDH Curve25519 encryption to decrypt payloads
5. Persistence: Backdoor installs via LaunchAgent, .ZSHRC injection, and Git hooks; kills notification agents
6. Exfiltration: Infostealer collects browser data, crypto wallets, Keychain, Telegram, and dev configs to /tmp for upload

Affected Systems

• macOS devices (Apple Silicon and Intel)
• macOS versions older than 13.0
• Web browsers (Chrome, Brave)
• Crypto wallet applications (Ledger)
• Telegram

Detection Availability

No detection rules or queries are published in the source article.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• macOS process execution logs
• macOS file system events
• LaunchAgent/LaunchDaemon creation logs
• Network proxy logs
• DNS resolution logs
• ZSH command history

Key Behavioral Indicators

• xattr -cr command executed by downloaded applications to remove quarantine
• zsh -s receiving piped input from non-standard processes
• LaunchAgent named com.apple.finder.agent created outside system context
• Modifications to .zshrc appending execution of hidden scripts
• Processes killing BTMNotificationAgent, NotificationCenter, BackgroundTaskManagementAgent
• Ad-hoc code signing of downloaded applications via codesign -fs - --deep

Control Gaps

• Standard AV may miss multi-layered encrypted payloads and binary droppers
• Network security may not inspect iCloud calendar traffic for malicious content
• Endpoint controls may not flag ad-hoc signed applications without quarantine attributes
• Git hook-based persistence may bypass endpoint monitoring
• PAM-based credential verification may not trigger existing macOS malware detections

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Block access to known malicious iCloud calendar URLs at network proxy
• Implement DNS filtering for attacker-controlled domains
• Monitor for HTTP requests with X-Upload-Token header to known C2 paths
• Inspect iCloud calendar traffic for embedded shell commands if feasible

User Protection

• Warn users about fake crypto wallet apps promoted on social media
• Disable automatic opening of downloaded DMG files
• Enable macOS Gatekeeper and prevent execution of ad-hoc signed applications
• Monitor for applications requesting keychain access via PAM API

Security Awareness

• Train developers on risks of downloading cracked or free software
• Advise users to verify crypto wallet apps through official app stores
• Warn about social media promotions for unverified software on X and Telegram
• Educate users on recognizing fake system password prompts and error dialogs

MITRE ATT&CK Mapping

Plain-Language Summary

A malicious software family called MacSync targets Mac users, especially software developers and cryptocurrency users, by pretending to be useful apps. Once installed through a downloaded disk image, it uses Apple's iCloud calendar service to sneak in more harmful code. It steals passwords, browser data, cryptocurrency wallets, and system files, then installs a backdoor for ongoing access. Users should avoid downloading cracked software or unverified crypto apps and ensure their security software is up to date.

Additional IOCs

• Domains:
  • streamyard[.]appstore[.]com[.]mx - Attacker-controlled domain hosting installer.sh
  • slack[.]apple03cloudstore[.]com - Attacker-controlled domain hosting installer.sh
  • waaako[.]appstore[.]com[.]mx - Attacker-controlled domain hosting installer.sh
• Urls:
  • hxxps://streamyard[.]appstore[.]com[.]mx/installer.sh - Installer script URL on attacker-controlled domain
  • hxxps://slack[.]apple03cloudstore[.]com/installer.sh - Installer script URL on attacker-controlled domain
  • hxxps://waaako[.]appstore[.]com[.]mx/installer.sh - Installer script URL on attacker-controlled domain
  • hxxps://toria[.]apple03cloudstore[.]com/e3c1a6b00bc31e14/stage2.enc - Encrypted stage two payload URL on C2
  • hxxps://docsend[.]appstore[.]com[.]mx/dcc737d157ef4271/stage2.enc - Encrypted stage two payload URL on C2
  • hxxps://docsend[.]appstore[.]com[.]mx/dcc737d157ef4271/CoreUpdate.pkg.enc - Encrypted core update package on C2
  • hxxps://docsend[.]appstore[.]com[.]mx/dcc737d157ef4271/Helper.pkg.enc - Encrypted helper package on C2
  • hxxps://docsend[.]appstore[.]com[.]mx/v1/asset - C2 endpoint for file upload initialization
  • hxxps://docsend[.]appstore[.]com[.]mx/v1/loader/dek - C2 endpoint for retrieving decryption key
  • hxxps://docsend[.]appstore[.]com[.]mx/v1/loader/log - C2 endpoint for logging/telemetry
  • hxxps://docsend[.]appstore[.]com[.]mx/pkgunpack - C2 endpoint for downloading pkgunpack utility
• File Hashes:
  • 2d69812584269699fade26622e6490c5 (SHA1) - Stage one loader hash
  • 7df1049cbd56c0bfa4a3364a379b4c2c (SHA1) - Stage one loader hash
  • 9f15fe9c4415cd668334339f705b94d8 (SHA1) - Stage one loader hash
  • fb90887592655a8c989e443c640167aa (SHA1) - Stage one loader hash
  • 6791dad263cac6d63ebba6a4b57e7d71 (SHA1) - Stage one loader hash
  • 781ce50001d4b449600afa347c9b0208 (SHA1) - Stage three dropper hash
  • 8e84b01d5ac9624f0b181ade0e737193 (SHA1) - Stage three dropper hash
  • 980e2134679bc0c609f7659882883d77 (SHA1) - Stage three dropper hash
  • 4203ec932bfcc0907f91732440d6d997 (SHA1) - Stage three dropper hash
  • eb760d5c88f13f7ee0f8f86ba3407123 (SHA1) - Stage three dropper hash
  • f9f70096aabb4d22a6657014f4853a53 (SHA1) - Stage three dropper hash
  • 3deeed48fd38f22e369f5c3092bd68a1 (SHA1) - Stage four dropper hash
  • f97d24212fa6a21be0c4d211e10f044c (SHA1) - Stage five script hash
  • 00d12d842596bf5ee1805effb4571d30 (SHA1) - Stage six script hash
  • 9a0043d900a9ac78c886c59c9a328fd0 (SHA1) - Stage six script hash
  • 7212229c85852c3bffaf9740002b2f39 (SHA1) - Auxiliary .repair-run script hash
  • fc3ba5ed282d77127efd0b0f2403531b (SHA1) - Backdoor hash
  • 8dc8561349d144d4661bc66f2ec49f9f (SHA1) - Auxiliary autorun tool hash
• File Paths:
  • /tmp/.sys-<16-digit random value> - Path for decrypted stage three dropper executable
  • $HOME/Library/Application Support/System - Backdoor backup and operational files directory
  • $HOME/Library/Logs/.sysnotif-agent.log - Backdoor log file path
  • /tmp/osalogging.zip - Staging archive for regrab command data exfiltration
  • /tmp/.sn-loader-${upload_token:-$$}.lock - Lock file preventing malware re-execution
  • /tmp/.45e7b90f.zip - Temporary zip archive during infection
  • /tmp/.sn-done-b8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650 - Completion marker file for stage execution
  • /tmp/.upd-$$ - Temporary update file during payload download
  • /tmp/.core-$$.enc - Encrypted core payload temporary file
  • /tmp/.core-$$.tar.gz - Decompressed core payload temporary file
  • /tmp/.pkgunpack-$$ - Temporary path for pkgunpack utility
  • /tmp/.zipchunks-$$ - Temporary chunked zip file for exfiltration
  • $HOME/.zshrc - ZSH config file modified for persistence
  • $HOME/Library/Keychains/login.keychain-db - Targeted keychain database for credential theft
• Command Lines:
  • Purpose: Remove quarantine attributes from downloaded app | Tools: xattr | Stage: Initial Access | xattr -cr <app_name>
  • Purpose: Pipe iCloud calendar content to zsh interpreter for execution | Tools: zsh | Stage: Execution | zsh -s
  • Purpose: Download and extract tar.gz archive from iCloud | Tools: curl, tar | Stage: Execution | curl -fsSL --max-time 120 $U | tar xzf - -C "$D"
  • Purpose: Ad-hoc sign downloaded application | Tools: codesign | Stage: Defense Evasion | codesign -fs - --deep "$app"
  • Purpose: Download, decrypt, and execute stage two payload | Tools: curl, openssl | Stage: Execution
  • Purpose: Modify keychain partition list to allow unauthorized access | Tools: security | Stage: Credential Access
  • Purpose: Check zip archive integrity before exfiltration | Tools: zip | Stage: Exfiltration | zip -T
  • Purpose: Calculate SHA-256 hash of exfiltration archive | Tools: shasum | Stage: Exfiltration | shasum -a 256
• Other:
  • com.apple.finder.agent - LaunchAgent name used for backdoor persistence
  • com.apple.quarantine - Extended attribute checked and removed by malware
  • b8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650 - X-Upload-Token value for C2 authentication
  • ff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51d - X-Upload-Token value for C2 authentication
  • pFSxn/Uwg9bS45aVKCzA+8exSMfDHXpbpHC/f7G472w= - Server public key for ECDH key exchange (build_pub_b64)
  • SONOMAC1 - Magic word marking encrypted URL overlay in binary
  • AGNT1 - Magic constant in backdoor configuration confirming decryption
  • BLD-150 - Backdoor build number in configuration
  • avd9mkcxgl - Mach-O identifier for backdoor executable
  • sn-dek-wrap-v1 - String concatenated with shared secret for SHA-256 key derivation
  • SNWK1 - AAD marker in AES-GCM encrypted payload header
  • daemon_function - Main function name in stage six script
  • KcHelper - Filename checked in app resources for keychain access feature