GoKawiilMacSync macOS malware now abuses public iCloud calendars for payload delivery
Kaspersky researchers report a new variant of the MacSync info-stealing malware that hides commands inside public iCloud calendar event descriptions to fetch additional payloads onto infected Macs. The malware, which evolved from the AMOS stealer family, has been spread via ClickFix-style social engineering, fake Homebrew and disk-analyzer tools, and a bogus crypto wallet app called Toria. A newly discovered Objective-C backdoor module disguises itself as Finder to maintain persistence.