Researchers Detail Decade-Old OS File-Notification Flaws and iCloud Calendar-Based Mac Malware

The Graz team, Sudheendra Raghav Neela, Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast and Daniel Gruss, found the flaws in subsystems that notify applications when files change, not what changed. Neela said the bugs are decades old and rooted in features every modern OS ships. Linux's inotify has been affected since 2005, Android's FileObserver since 2008, Windows' ReadDirectoryChangesW since 2000 and macOS' FSEvents since 2007, according to the report.

The issue arises because unprivileged users can access the file-notification subsystem, including files readable by multiple users. On Linux, watching a readable directory leaks events on files inside it that the watcher cannot read. Watching /dev/input produces a notification for every keystroke, which the researchers turned into a local inter-keystroke timing attack with 93.1% to 100% keystroke accuracy across seven users and a remote SSH attack at 100%, Neela said. The reported attacks can also help infer visited websites and possibly steal login credentials through UI redress.

Linux shipped partial mitigations, including CVE-2025-68788, which stops inotify from generating certain access and modify events for special files. The fix reached multiple kernels and Linux distributions but addresses only part of the broader techniques the researchers described. Microsoft and Apple acknowledged the findings but did little, according to the report. Microsoft told the researchers that ReadDirectoryChangesW behaves "by-design", although the feature is undocumented, and said monitoring file paths across users is not a vulnerability worthy of a patch. The report does not mention Apple taking action. A demo is expected at ACM CCS 2026.

According to TechRadar, Kaspersky's MacSync campaign uses a loader that reaches out to iCloud calendar after execution, a benign-looking activity, and looks for a specific public event built by attackers. The event description contains instructions and the location of the actual infostealer, which is also stored in iCloud. The loader is advertised through social media, SEO poisoning and phishing, with victims directed to fraudulent websites or channels promoting cracked software, free advanced tools or, in at least one example, a cryptocurrency wallet. Victims see a ClickFix error and are told to paste a command into Terminal, which deploys the loader and installs MacSync.

MacSync emerged in April 2025 and was initially spun out of AMOS, a popular macOS information stealer, and is based on Swift. It can exfiltrate browser history, cookies, saved credentials, cryptocurrency wallet and app data, Telegram data, Keychain data, system and device information, and SSH, AWS, Kubernetes, Git and shell configuration files. Newer variants add an Objective-C backdoor that spoofs Finder, establishes persistence, terminates notification processes to prevent alerts and gives attackers backdoor access, including running AppleScript received from a command-and-control server, deploying browser extensions, replacing the legitimate Ledger wallet app and collecting more system information.

Kaspersky also found an undefined command called "live_browser", which downloads and runs a component named "sn_relay"; its purpose has not been established. The researchers said newer versions differ significantly from older ones and that the attackers substantially overhauled their approach. They said the data sought and the applications MacSync disguises itself as show the malware primarily targets developers, crypto enthusiasts and other users associated with IT and crypto. Kaspersky urged Mac users to be cautious when downloading programs, especially from third-party websites, and to be skeptical of apps that prompt for an administrator password. The full list of indicators of compromise is available in Kaspersky's report.