MacSync under the microscope: new delivery methods and a new payload
ID: bb96292e-bc3e-5b39-ac3d-d59dbef11874
STIX ID: report--bb96292e-bc3e-5b39-ac3d-d59dbef11874
Feed Name: Securelist by Kaspersky
Threat Score
MacSync is an actively used, evolving macOS infostealer family that has shifted from AppleScript droppers to multi-stage binary droppers and Objective-C/Swift payloads; this report documents a complex infection chain (malicious DMGs → loader → multiple droppers → infostealer and backdoor), novel delivery via iCloud calendar entries, sophisticated crypto (Curve25519 ECDH, AES-GCM), persistence mechanisms, data exfiltration in large chunks, and extensive IoCs and C2 details targeting developers and crypto users.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.