MacSync under the microscope: new delivery methods and a new payload

    Friday, September 25, 2026 In: Threat Research Print

    Date: 09/25/2026

    Severity: High

    Summary

    The new MacSync macOS infostealer uses revamped binary-based delivery, with Objective-C/Swift payloads and DMG-based infection chains, including abuse of iCloud Calendar for payload delivery. The malware employs AES encryption, ECDH Curve25519, anti-debugging, and in-memory execution while establishing persistence through LaunchAgents, ZSHRC, and Git hooks. Its infostealer targets browser credentials, cookies, crypto wallets, Keychain data, Telegram, SSH/AWS/Kubernetes/Git configurations, and command history, while a backdoor provides additional attacker access. 

    Indicators of Compromise (IOC) List

    DOmain/URLs

    https://toria.app/

    https://warpcast.asia/Toria.dmg

    https://streamyard.appstore.com.mx/installer.sh

    https://slack.apple03cloudstore.com/installer.sh

    https://toria.apple03cloudstore.com/

    https://waaako.appstore.com.mx/installer.sh

    https://toria.apple03cloudstore.com/e3c1a6b00bc31e14/stage2.enc hxxps://docsend.appstore.com.mx/dcc737d157ef4271/stage2.enc

    https://docsend.appstore.com.mx/dcc737d157ef4271/CoreUpdate.pkg.enc

    https://docsend.appstore.com.mx/dcc737d157ef4271/Helper.pkg.enc

    https://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08

    https://gateway.icloud.com/caldav/1_MTk1NDMwMDMzNTUxOTU0M0pybtJB186GzhogprwCQUjY3oZNiDFHH8WVo6bmgUtI/attach/4GE4TKNBTGAYDGMZVGUYTSNJUGOAALDAFMDOJBGWNUCYJLZRNDCLCO2YMQ3I64RLGMNXVG3KYBPWQOGYIEI7MPBDDYHECFDYVENTXIYFNDCPOVRMCTYI236RCYZAE63V5U3RTUYGUMO2CO7PKCLWMCXE73M7OPTHSGRWH5DXQ4PCUQU4ELZTLW54JSTK2H7VQ6PD26WOA2R7PPIQ6RTJWDEWP34U3HB4YWMXXC6EJ6PKWILSPYRSDEVY6QGMWSIUN6PR5W35KO3D4QZE7CFPUVBAEKI/Loader.app.tar.gz/YXR0YWNoYXR0YWNoYXR0YRhrE8mQ0E-b_dTUSGStQgTQ0ULFxCanei3Ke-EuEyQL

    https://docsend.appstore.com.mx

    https://toria.apple03cloudstore.com

    Hash

    26a0f7cdb9f7dc5ace9a40af825b1538

    2d69812584269699fade26622e6490c5

    7df1049cbd56c0bfa4a3364a379b4c2c

    9f15fe9c4415cd668334339f705b94d8

    fb90887592655a8c989e443c640167aa

    6791dad263cac6d63ebba6a4b57e7d71

    3ded1d71a822b53b12c3b67bcaf633f5

    781ce50001d4b449600afa347c9b0208

    8e84b01d5ac9624f0b181ade0e737193

    980e2134679bc0c609f7659882883d77

    4203ec932bfcc0907f91732440d6d997

    eb760d5c88f13f7ee0f8f86ba3407123

    f9f70096aabb4d22a6657014f4853a53

    3deeed48fd38f22e369f5c3092bd68a1

    f97d24212fa6a21be0c4d211e10f044c

    00d12d842596bf5ee1805effb4571d30

    9a0043d900a9ac78c886c59c9a328fd0

    7212229c85852c3bffaf9740002b2f39

    c53d0ea45dbc622afb7f16ea3eec78bc

    fc3ba5ed282d77127efd0b0f2403531b

    8dc8561349d144d4661bc66f2ec49f9f

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "https://toria.apple03cloudstore.com/" or url like "https://toria.apple03cloudstore.com/" or siteurl like "https://toria.apple03cloudstore.com/" or domainname like "https://slack.apple03cloudstore.com/installer.sh" or url like "https://slack.apple03cloudstore.com/installer.sh" or siteurl like "https://slack.apple03cloudstore.com/installer.sh" or domainname like "https://toria.app/" or url like "https://toria.app/" or siteurl like "https://toria.app/" or domainname like "https://docsend.appstore.com.mx/dcc737d157ef4271/Helper.pkg.enc" or url like "https://docsend.appstore.com.mx/dcc737d157ef4271/Helper.pkg.enc" or siteurl like "https://docsend.appstore.com.mx/dcc737d157ef4271/Helper.pkg.enc" or domainname like "https://streamyard.appstore.com.mx/installer.sh" or url like "https://streamyard.appstore.com.mx/installer.sh" or siteurl like "https://streamyard.appstore.com.mx/installer.sh" or domainname like "https://waaako.appstore.com.mx/installer.sh" or url like "https://waaako.appstore.com.mx/installer.sh" or siteurl like "https://waaako.appstore.com.mx/installer.sh" or domainname like "https://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08" or url like "https://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08" or siteurl like "https://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08" or domainname like "https://gateway.icloud.com/caldav/1_MTk1NDMwMDMzNTUxOTU0M0pybtJB186GzhogprwCQUjY3oZNiDFHH8WVo6bmgUtI/attach/4GE4TKNBTGAYDGMZVGUYTSNJUGOAALDAFMDOJBGWNUCYJLZRNDCLCO2YMQ3I64RLGMNXVG3KYBPWQOGYIEI7MPBDDYHECFDYVENTXIYFNDCPOVRMCTYI236RCYZAE63V5U3RTUYGUMO2CO7PKCLWMCXE73M7OPTHSGRWH5DXQ4PCUQU4ELZTLW54JSTK2H7VQ6PD26WOA2R7PPIQ6RTJWDEWP34U3HB4YWMXXC6EJ6PKWILSPYRSDEVY6QGMWSIUN6PR5W35KO3D4QZE7CFPUVBAEKI/Loader.app.tar.gz/YXR0YWNoYXR0YWNoYXR0YRhrE8mQ0E-b_dTUSGStQgTQ0ULFxCanei3Ke-EuEyQL" or url like "https://gateway.icloud.com/caldav/1_MTk1NDMwMDMzNTUxOTU0M0pybtJB186GzhogprwCQUjY3oZNiDFHH8WVo6bmgUtI/attach/4GE4TKNBTGAYDGMZVGUYTSNJUGOAALDAFMDOJBGWNUCYJLZRNDCLCO2YMQ3I64RLGMNXVG3KYBPWQOGYIEI7MPBDDYHECFDYVENTXIYFNDCPOVRMCTYI236RCYZAE63V5U3RTUYGUMO2CO7PKCLWMCXE73M7OPTHSGRWH5DXQ4PCUQU4ELZTLW54JSTK2H7VQ6PD26WOA2R7PPIQ6RTJWDEWP34U3HB4YWMXXC6EJ6PKWILSPYRSDEVY6QGMWSIUN6PR5W35KO3D4QZE7CFPUVBAEKI/Loader.app.tar.gz/YXR0YWNoYXR0YWNoYXR0YRhrE8mQ0E-b_dTUSGStQgTQ0ULFxCanei3Ke-EuEyQL" or siteurl like "https://gateway.icloud.com/caldav/1_MTk1NDMwMDMzNTUxOTU0M0pybtJB186GzhogprwCQUjY3oZNiDFHH8WVo6bmgUtI/attach/4GE4TKNBTGAYDGMZVGUYTSNJUGOAALDAFMDOJBGWNUCYJLZRNDCLCO2YMQ3I64RLGMNXVG3KYBPWQOGYIEI7MPBDDYHECFDYVENTXIYFNDCPOVRMCTYI236RCYZAE63V5U3RTUYGUMO2CO7PKCLWMCXE73M7OPTHSGRWH5DXQ4PCUQU4ELZTLW54JSTK2H7VQ6PD26WOA2R7PPIQ6RTJWDEWP34U3HB4YWMXXC6EJ6PKWILSPYRSDEVY6QGMWSIUN6PR5W35KO3D4QZE7CFPUVBAEKI/Loader.app.tar.gz/YXR0YWNoYXR0YWNoYXR0YRhrE8mQ0E-b_dTUSGStQgTQ0ULFxCanei3Ke-EuEyQL" or domainname like "https://docsend.appstore.com.mx" or url like "https://docsend.appstore.com.mx" or siteurl like "https://docsend.appstore.com.mx" or domainname like "https://docsend.appstore.com.mx/dcc737d157ef4271/CoreUpdate.pkg.enc" or url like "https://docsend.appstore.com.mx/dcc737d157ef4271/CoreUpdate.pkg.enc" or siteurl like "https://docsend.appstore.com.mx/dcc737d157ef4271/CoreUpdate.pkg.enc" or domainname like "https://toria.apple03cloudstore.com" or url like "https://toria.apple03cloudstore.com" or siteurl like "https://toria.apple03cloudstore.com" or domainname like "https://warpcast.asia/Toria.dmg" or url like "https://warpcast.asia/Toria.dmg" or siteurl like "https://warpcast.asia/Toria.dmg"

    Detection Query 2 :

    md5hash IN ("4203ec932bfcc0907f91732440d6d997","00d12d842596bf5ee1805effb4571d30","fb90887592655a8c989e443c640167aa","c53d0ea45dbc622afb7f16ea3eec78bc","f97d24212fa6a21be0c4d211e10f044c","fc3ba5ed282d77127efd0b0f2403531b","8e84b01d5ac9624f0b181ade0e737193","26a0f7cdb9f7dc5ace9a40af825b1538","eb760d5c88f13f7ee0f8f86ba3407123","6791dad263cac6d63ebba6a4b57e7d71","781ce50001d4b449600afa347c9b0208","3deeed48fd38f22e369f5c3092bd68a1","9a0043d900a9ac78c886c59c9a328fd0","3ded1d71a822b53b12c3b67bcaf633f5","8dc8561349d144d4661bc66f2ec49f9f","7212229c85852c3bffaf9740002b2f39","9f15fe9c4415cd668334339f705b94d8","7df1049cbd56c0bfa4a3364a379b4c2c","980e2134679bc0c609f7659882883d77","f9f70096aabb4d22a6657014f4853a53","2d69812584269699fade26622e6490c5")

    Reference:    

    https://securelist.com/macsync-new-version/121383/


    Tags

    MalwareInfostealerCredential HarvestingCrypto walletsTelegramAWSBackdoor

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.