MACSYNC MALWARE NOW SPREADS VIA ICLOUD CALENDARS

Security researchers identified the updated MacSync variant using Apple's iCloud calendar service as a command-and-control mechanism. The malware creates or accesses publicly shared calendar events to retrieve instructions for downloading and executing new payloads on infected systems. This method leverages legitimate Apple infrastructure, potentially evading network-based detection systems that typically flag suspicious domains and servers. By embedding malicious instructions within calendar event metadata, attackers can update compromised machines without traditional server communication patterns. MacSync primarily targets macOS users through trojanized applications and malicious downloads. Previous versions relied on conventional distribution channels and C2 servers. Apple users should verify calendar sharing settings and monitor for unexpected calendar invitations or modifications. Security teams recommend maintaining current system patches and using endpoint detection tools capable of analyzing calendar service activity.