Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Receiving or viewing an iCloud calendar invitation does not, by itself, run malware on your Mac. In a MacSync campaign reported by Kaspersky in September 2026, the calendar was used as an intermediate source for commands only after a user had downloaded and run a malicious app or loader. The observed calendar technique appeared in at least one sample; other samples retrieved instructions from attacker-controlled servers.
How the iCloud calendar was used in the MacSync attack
Kaspersky describes a chain that began with a malicious disk image (DMG), not with a calendar invitation. A loader inside the downloaded app removed the file’s quarantine attribute and decrypted a link to the next stage. In at least one sample, that link pointed to a public iCloud calendar.
The already-running loader fetched the calendar data and passed its lines to the zsh shell. Ordinary calendar text was not valid shell syntax and produced errors; commands placed after an event’s DESCRIPTION: line were interpreted by the shell. Those commands fetched a compressed archive hosted on iCloud, which contained an app bundle used to continue the infection chain. Kaspersky’s technical report documents this behavior.
This is different from an event being displayed in Apple Calendar. The report describes malicious software actively retrieving and processing calendar data after it was running; it does not report that Apple Calendar itself was compromised or that accepting or viewing an invite executes its contents.
#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
How victims were lured into running the first app
Kaspersky characterizes MacSync as malware-as-a-service, with campaign operators choosing how to deliver it. The newer samples began with malicious disk images and social engineering. One reported lure promoted a nonexistent cryptocurrency wallet called Toria through a dedicated page and social media. Fake or cracked software were also cited as delivery approaches. Help Net Security’s coverage describes the campaign context.
The newer payload used Swift and Objective-C components, whereas earlier versions had used AppleScript. The calendar was only one possible way to retrieve the next-stage commands: Kaspersky found other samples whose links led to attacker-controlled servers.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
What MacSync tried to steal
Kaspersky reports that the infostealer targeted a broad collection of personal and developer data, including:
- Browser history, cookies, saved logins and passwords.
- Cryptocurrency wallet data and Telegram information.
- The device login and password, the Keychain file, system information and shell command history.
- Developer configuration related to SSH, AWS, Kubernetes and Git.
The same campaign also included a separate Objective-C backdoor disguised as Finder. It established persistence through a LaunchAgent named com.apple.finder.agent, changes to .zshrc, and global Git hooks. Kaspersky says a helper terminated several notification processes to suppress an alert about the new LaunchAgent. The backdoor could run attacker-supplied AppleScript and perform other tasks, but the researchers did not have the server-supplied scripts for every command and inferred some purposes from command names and status messages.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
What is known—and not known—about the other components
Kaspersky could not determine what the sn_relay component did. A possible role in intercepting browser traffic was a suspicion based on command names and server messages, not a confirmed capability. The available reporting also does not establish a victim count, prevalence estimate or financial-loss figure for this campaign.
What to do if you encountered a suspicious download or command
- Do not paste unfamiliar commands from a website, message or calendar event into Terminal.
- Avoid suspicious DMG downloads, especially software that is fake, cracked or promoted through an unexpected link.
- Treat an unexpected administrator-password prompt cautiously. Do not enter credentials unless you understand what requested them and why.
- If you believe you ran a suspicious installer or command, stop using the affected Mac for sensitive account access and seek trusted security assistance. The reporting does not validate a MacSync-specific cleanup procedure, so avoid improvising one from the campaign description.
These precautions address the behavior described in the reporting; the sources do not endorse a particular security product or establish that any specific tool detects or removes this MacSync variant.
Quick Recap
Best Value
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Rank #4
![Norton 360 Premium 2027 Antivirus, 10 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41JNWru8mYL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 10 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
