A new Mac malware family has found a way to make Apple’s own infrastructure carry its code, turning a service that corporate networks trust into a staging server.
Moonlock Lab, the research arm of MacPaw, tracks the family as SONOMAC1 and calls it Sonoma, a tag baked into the launcher’s Mach-O strings rather than a nod to the macOS release. It is a compiled Swift stealer that links against libpam and libsqlite3, harvesting passwords, browser data, developer secrets and crypto wallets while hiding as a background app absent from the Dock.
Infections begin with lookalike installers for StreamYard, Slack and other collaboration, document and wallet-adjacent brands, often after a calendar invitation. Nothing inside the bundle carries a real signature: no Team ID, no notarization, no Developer ID. Gatekeeper’s quarantine attribute is then stripped away, and a second stage arrives through a pipe into zsh, so almost none of the chain settles on disk.
The notable step comes next. One chain pulls a loader archive from gateway.icloud.com/caldav and unpacks it under a hidden directory in /tmp. Because that endpoint presents Apple’s own certificate, blocking it would break real calendar sync, so throwaway iCloud accounts become a resilient delivery channel.
Sonoma verifies the login password through PAM instead of calling out to dscl or AppleScript, trimming the child processes that endpoint sensors flag. Browser stores that stay locked while Chrome, Brave, Arc, Firefox or Safari run get cloned through SQLite’s backup interface rather than copied, and the haul of cookies, logins and wallet files is uploaded to a server at 109.94.171.225.
Moonlock distinguishes the code from PamStealer, which Jamf documented earlier in connection with Avenger, and notes shared artifacts including a /tmp/osalogging.zip archive long tied to MacSync. Detections so far cluster in Spain and Japan.
