[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faCSR_DdHPHmmFJeZXycJLc29rfCIh9qTdhzKxqT9iqc":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"42bfca48-573b-4cce-be62-0c20e16417e6","MacSync malware uses public iCloud calendars to deliver new payloads","macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads-726569","A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads. [...]","A new variant of the MacSync info-stealing malware for macOS has been discovered using public iCloud calendar events to deliver its payloads. This malware, which emerged in April 2025, has been observed in ClickFix campaigns and disguised as legitimate tools. It has evolved with new modules, including a backdoor that can execute attacker-supplied scripts and deploy malicious browser extensions.","MacSync malware uses public iCloud calendars to deliver new macOS payloads.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmacsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F18\u002FApple.jpg","2026-09-24T20:53:35+00:00","2026-09-24T22:00:29.437072+00:00",8,[17],{"name":18,"type":19},"iCloud Calendar","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":41,"vendors":123},[42,68,97],{"slug":43,"name":44,"problem":45,"products":46},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":64,"product_name":65,"url":66,"description":67},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"slug":69,"name":70,"problem":71,"products":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":98,"name":99,"problem":100,"products":101},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[102,108,115],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":103,"product_name":104,"url":106,"description":107},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":98,"product_name":112,"url":113,"description":114},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":140},"macsync-malware-hijacks-icloud-calendars-to-deliver-payloads","MacSync Malware Hijacks iCloud Calendars to Deliver Payloads","The MacSync malware exploits a legitimate, trusted service — public iCloud calendars — as a command-and-control channel, making malicious activity difficult to distinguish from normal user behavior. It spreads through ClickFix social engineering campaigns where users are tricked into executing malicious scripts disguised as legitimate tools, highlighting a critical gap in user awareness. The malware's modular design, including a backdoor and rogue browser extensions, allows attackers to persist and expand their foothold over time. This matters because abusing trusted cloud platforms bypasses many traditional security controls that rely on blocklisting known-bad infrastructure.",[129,130,131,132,133,134,135,136,137,138,139],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-4: Information Flow Enforcement","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1102: Web Service (Command and Control)","MITRE ATT&CK T1176: Browser Extensions","MITRE ATT&CK T1204: User Execution",{}]