What would you do if the applications that have become a core part of your operations turned into digital attack vectors? Learn how cybercriminals can deliver macOS malware through attacker-controlled public iCloud calendars and cloud storage.
A Devious Way To Bypass Traditional Defenses
Cybersecurity has come a long way, and directly infecting systems with malicious files is fairly difficult. For this type of attack to work, a threat actor needs to successfully trick the victim into downloading and running the deceptive program on their device.
Even if they're successful, up-to-date antivirus and firewall solutions would quickly flag malware before it can do lasting damage. Criminals would also have to repeat this tedious process each time they want to deploy another type of malware.
Unfortunately, several workarounds exist, such as malware loaders and DLL sideloading. This two-phase approach (initial infection and deployment of malicious payloads) gives threat actors more flexibility and lowers detection rates.
Why iCloud Calendar?
Modern defenses monitor incoming and outgoing traffic across applications, so they can still detect when a loader tries to deploy Mac malware. The problem only comes when criminals manage to hide this traffic.
Here's how they do it:
- Lure in victims: Threat actors distribute MacSync through social engineering and malicious software. One recent campaign promoted a fake cryptocurrency wallet through social media.
- Trigger the initial infection: The victim downloads and launches a malicious application from a DMG file. The malware also appeared in previous ClickFix campaigns, tricking users into running Terminal commands.
- Connect to iCloud: Once the malicious application is running, a downloader retrieves data from a public iCloud Calendar controlled by the attackers.
- Retrieve hidden commands: The malware feeds the calendar data into the Mac's zsh shell. Attacker-controlled commands hidden in an event description then retrieve another malicious payload.
Unfortunately, this has the potential to become a lingering issue. Attackers can update calendar events with new commands, letting them maintain control while staying hidden.
What Is MacSync?
MacSync is the information-stealing malware at the other end of this attack. After deployment, it searches the infected Mac for valuable data and sends what it finds to attacker-controlled infrastructure.
Your typical work computer can hold plenty worth stealing. Saved passwords and browser information are common targets, along with files and cryptocurrency data. If the attacker manages to steal a company login, it might make the rest of your systems vulnerable as well.
How Can You Protect Your macOS Devices?
The key is to prevent malicious software from gaining an initial foothold on your Mac. Consider these proactive steps:
- Stick to trusted vendors and legitimate marketplaces instead of cracked or supposedly free software.
- Train employees to question websites that ask them to paste unfamiliar commands.
- Monitor unexpected processes and suspicious use of legitimate cloud services.
- Use multifactor authentication and secure business credentials with a password manager.
If you suspect a Mac malware infection, isolate the affected device and treat any credentials stored on it as potentially exposed. Reset those accounts from a clean device and review recent activity for signs of data theft or evidence that the breach has spread elsewhere.
