# MacSync malware uses public iCloud calendars to deliver new payloads

> **Open Intelligence Dossier** · First detected: 2026-09-25 18:00 UTC · Category: Technology

## Executive Summary
MacSync and PamStealer malware variants target macOS users with new payload delivery methods.

## Intelligence Brief
Recent coverage details multiple security developments concerning macOS threats, specifically involving malware strains identified as MacSync and PamStealer. According to reporting from BleepingComputer, the MacSync malware now uses public iCloud calendars to deliver new payloads to infected systems. Additional reporting from securelist.com notes that a new version of the MacSync macOS stealer specifically targets crypto enthusiasts and developers. Simultaneously, coverage from The Hacker News and SOC Prime highlights that PamStealer has moved to Swift while adding live C2 payload decryption and multi-layer persistence. TechRadar also reported on the MacSync activity, focusing on the mechanism that uses iCloud calendar invites to attempt data theft from users.


The reports feature detailed analyses from outlets including BleepingComputer, securelist.com, The Hacker News, SOC Prime, and TechRadar. These publications emphasize the technical evolution of both malware families. BleepingComputer concentrates on the iCloud calendar payload delivery vector. Securelist.com focuses on the specific targeting profiles of crypto enthusiasts and developers. The Hacker News and SOC Prime place their emphasis on PamStealer moving to Swift, implementing server-side decryption, and establishing multi-layer persistence.


The context provided across these reports establishes an ongoing trend of macOS-focused infostealers updating their tactics to evade detection and improve operational efficiency. The targeting of specific user demographics, such as cryptocurrency users and software developers, indicates a focus on high-value data. Furthermore, the adoption of legitimate infrastructure like public iCloud calendars for payload delivery represents an effort to blend malicious traffic with normal user activity, complicating traditional monitoring and defensive responses. Coverage does not yet specify the full scale of infections, the exact identity of the threat actors behind the campaigns, or concrete remediation timelines from affected software providers. Readers and security analysts must watch upcoming reports from these security outlets for further technical breakdowns, indicators of compromise, and potential defensive updates from platform providers regarding the abuse of cloud calendar services.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| SOC Prime | PamStealer Moves to Swift With Server-Side Decryption | [Source Link](https://news.google.com/rss/articles/CBMioAFBVV95cUxPNk1HSkVXalNJN0lIam1RY0RMOXlTZjdRZXg4dmI5NVJiRlBZOFFpdWk4X3JwTHIzc2hMWTJIM0dOdER0dEJLeEQwYm1xRGFnNnphT2t1Sng1cmlsaE1kZnl0a3gwbzZucS1FcXRKQmQyUGl6QU9ON3U4cjc0X2lreWZJbWZmN2J0UmUtWHVBUFlNMFFNaE55bUdpUlc4TDN3?oc=5) |
| TechRadar | This Mac malware is somehow using iCloud calendar invites to try and steal your data | [Source Link](https://news.google.com/rss/articles/CBMiwAFBVV95cUxNQm9mSV9UY1lvcXUyU0dzTmExN3NCanY5cDhrbWh1c0pubWlCV3Vvc2NSbHlIbnJOSS1LeTB5V3d5dXdwdkV5dnNTQVE1NXp5dWFrNEZXUE1fMFdHd3VsMi1zajhKM3p6aXVpWmp1aHBvYXViTDNCTlRqMjlTdFFjUXR1R0lleW4tamliMUYzSUpDSXFhb1dxR2pueFhaMW9naDQ5Sy1ucmdOZVhqcklZVFctYkI2VUM1a1p5MWMzWVo?oc=5) |
| securelist.com | A new version of the MacSync macOS stealer targets crypto enthusiasts and developers | [Source Link](https://news.google.com/rss/articles/CBMiX0FVX3lxTE8yWjY4V0ZnNmRHY0dNdk51Y3lqcmV6N1JjR0RMRWRtc2Z6aXpEWTZVZW5rcGRkeHF4OW9JWERkRlFSUl9QWEpYMmhQem50WlltUEhJRmFnQWhkdW1JcE5z?oc=5) |
| The Hacker News | PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence | [Source Link](https://news.google.com/rss/articles/CBMiggFBVV95cUxOZTlhczE5dXdXYjhNT1pnNHEwT2xvVVh2NUU5Y0M0c0tXMnl2X3dpSlJHd2lpbkZVREwtQXZNaG9LRjNzNHBiZUpYVEstUl9NN2lPZHRJbEZDdlNkQzR3QnRmRTItT0dLcDN6SkxHOFVPemhKZE14VEpJeWtzRUlzdTJR?oc=5) |
| BleepingComputer | MacSync malware uses public iCloud calendars to deliver new payloads | [Source Link](https://news.google.com/rss/articles/CBMitwFBVV95cUxPeTFuSHhOUWhwYWRabUVDWnNoOXpteVNha0tieElqMllmWHprRHZTVERuY1NWLUdHS2pBbUJ6VS1DbXJnNGpoS0hONHV4TktVZ0w4QlgxMmNhNDg1RlY0eUxZMzNoQ2piUWhKRTczOWV3SEQ4SlExTk8wX3VTZEJsZ1FhVl9hZC1MaUFBQ3QyTDdVLWhBUVFFYVRLU1p6ZnRDUFlobjNtTEF2MkxVUmg0YXlVeTdpeGfSAbwBQVVfeXFMT1pyX0hTRDJJbFNLVEktX1psZHlpdkNTTDVVa0lFSXhKQ0NwMXNfZ3pQckdvWkFWTXFzX3YyR3B0a24wbzRsN3JYYUtWbGFhLWtBZjJMQjQxVVNKbk05bktjVGphbzBvVDlmcURMeC1BZHhXUGpjb3NFOEVEOVJndmdYYmhKQkp6Vmk2U0ZwV240M2t6Y0xtZk1mb05) |

---
*Canonical Source: https://pulse.byoaiapps.com/trend/2026-09-25/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads*