A new variant of the MacSync malware has emerged, targeting macOS systems by leveraging public iCloud calendar events to distribute new native payloads. This development marks a significant shift in the threat actor's tactics, moving away from traditional delivery methods to exploit the accessibility of user-shared calendar data.
The malware operates by identifying public iCloud calendars, which are often accessible without authentication, and using the events within them as a mechanism to fetch and execute malicious code. By utilizing this method, the attackers can update their payloads dynamically, allowing them to deploy new threats without needing to compromise the initial infection vector repeatedly.
Security researchers noted that this approach allows the MacSync malware to maintain persistence and evade detection more effectively. The use of legitimate, publicly available services like iCloud calendars makes the traffic associated with the malware appear less suspicious to standard security monitoring tools, blending malicious activity with normal user behavior.
Users with public iCloud calendars may be at higher risk if their calendar data is being monitored by malicious actors. While the specific technical details of the payload delivery remain under analysis, the reliance on public data sources highlights the potential security implications of sharing personal information through cloud-based services.
Experts recommend that macOS users review their iCloud privacy settings to ensure that only necessary data is made public. Disabling public access to calendars and other personal information can reduce the attack surface available to malware operators seeking to deliver new payloads through these channels.
<small>Source: Bleeping Computer — read the original story there.</small>
