MacSync info-stealing malware hides malicious commands in an iCloud calendar
Overview
A new variant of MacSync malware is targeting Mac users by stealing sensitive information such as login credentials and crypto wallet data. Discovered by Kaspersky, this malware spreads through a crypto wallet application named Toria, which has been promoted on platforms like X and Telegram. The MacSync malware family, which first appeared in 2025, has evolved to include a persistent backdoor that allows attackers continued access to infected systems. This poses significant risks to users, particularly those involved in cryptocurrency, as their financial and personal data could be compromised. Users should be cautious about downloading apps from unverified sources and consider enhancing their security measures to protect against such malware.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Mac users, specifically those using the Toria crypto wallet app
- Action Required: Users should avoid downloading apps from unverified sources and consider using security software to detect and remove malicious applications.
- Timeline: Newly disclosed
Original Article Summary
A new MacSync variant targets Mac users with an infostealer and persistent backdoor designed to steal credentials, crypto wallet data, and files, according to Kaspersky. Researchers found the malware spreading through a crypto wallet app called Toria, which had its own website and was promoted on X and Telegram. MacSync is a family of Mac malware that emerged in 2025 as Mac.c and was later renamed. Early versions used AppleScripts that closely resembled the AMOS … More → The post MacSync info-stealing malware hides malicious commands in an iCloud calendar appeared first on Help Net Security.
Impact
Mac users, specifically those using the Toria crypto wallet app
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Newly disclosed
Remediation
Users should avoid downloading apps from unverified sources and consider using security software to detect and remove malicious applications.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Malware, Kaspersky.