Home · Technology · Oct 4 archive
MacSync Malware Hides Commands in iCloud Calendar
Confirmed
In Short: While MacSync malware uses iCloud calendars to hide commands, it is important for users to remain vigilant and secure their devices by regularly updating software and being cautious with downloads.
Researchers have discovered a new tactic used by the MacSync malware, an information-stealing malware family targeting macOS devices. The malware hides commands within public iCloud calendar events to download additional malicious software.
According to Fox News, the calendar itself does not infect your computer simply by receiving an invitation. However, once MacSync gains access, it can steal a wide range of data beyond just calendar entries.
Microsoft Threat Intelligence tracked a shift in the macOS ClickFix operation, which now uses Terminal commands to fetch remote scripts instead of shipping disk images. This shift includes server-side gates that hide malicious pages from crawlers and sandboxes.
The server-side gate presents selected Mac users with a fake software download, while probes specifically hunt for analysts by checking if the browser's developer console is open or if the browser is faking codec support in JavaScript.
Google's new product, CC, allows family members to share calendars and task lists, pooling information from Gmail, Calendar, and Drive. This feature helps manage household schedules and reminders more efficiently.
Caddy, an AI assistant featured in TechCrunch, turns scattered information on phones into actionable tasks, such as scheduling appointments, organizing calendars, or sending emails.
What this adds
The iCloud calendar trick highlights the evolving tactics of malware creators who exploit trusted services to hide malicious activities.
What's confirmed
- Researchers have discovered a new tactic used by the MacSync malware, an information-stealing malware family targeting macOS devices. The malware hides commands within public iCloud calendar events to download additional malicious software.
- According to Fox News, the calendar itself does not infect your computer simply by receiving an invitation. However, once MacSync gains access, it can steal a wide range of data beyond just calendar entries.
- Microsoft Threat Intelligence tracked a shift in the macOS ClickFix operation, which now uses Terminal commands to fetch remote scripts instead of shipping disk images. This shift includes server-side gates that hide malicious pages from crawlers and sandboxes.
- The server-side gate presents selected Mac users with a fake software download, while probes specifically hunt for analysts by checking if the browser's developer console is open or if the browser is faking codec support in JavaScript.
- Google's new product, CC, allows family members to share calendars and task lists, pooling information from Gmail, Calendar, and Drive. This feature helps manage household schedules and reminders more efficiently.
- Caddy, an AI assistant featured in TechCrunch, turns scattered information on phones into actionable tasks, such as scheduling appointments, organizing calendars, or sending emails.
What's still developing
- Still, the iCloud trick shows how attackers can hide parts of an attack behind familiar services many of us trust.
- Kaspersky found one MacSync infection chain where a downloader connected to a public iCloud calendar.
- That is a good reminder that a polished website or active social media account tells you very little about whether software deserves your trust.
- You probably use your calendar to keep track of appointments, birthdays and the occasional reminder you immediately snooze.
- Here's how MacSync works, what it can steal and the steps you can take to protect your Mac.
- Kurt "CyberGuy" Knutsson walks you through five practical ways AI can help you prepare for appointments, remember important details, understand complicated medical information, research prescription questions and organize your next steps.
- A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks.
- "Our film, Anything but Ghosts, is officially hitting theaters May 7, 2027 — put it your calendar," the duo said in almost unison.
- "Curry has said that Nikki's fate will be shown in his next movie," Navarrette teased.
- "It'll say onscreen that a girl was charged with a triple homicide. I've mostly stayed off social media, but I did see somebody post that they would be my lawyer, and I thought, "Maybe she doesn't go to jail if this person is defending me.
- Email * Your email address will not be published.
- By providing your information, you agree to our Terms of Use and our Privacy Policy.