MacSync Hides Commands in iCloud Calendar Events to Download More Malware

Q: What is the true purpose of the mysterious sn_relay component secretly downloaded onto infected Mac devices?

Its true purpose is still unknown. Kaspersky, which uncovered the latest MacSync chain, said it could identify that the backdoor’s `live_browser` command downloads and executes a file called `sn_relay`, but researchers could not determine what that component actually does because they did not have the AppleScript or full follow-on payloads used by the attackers. In other words, there is no confirmed public evidence yet that definitively explains `sn_relay`’s function. That said, the surrounding evidence points to a likely role rather than a proven one. The command name `live_browser`, the broader MacSync feature set, and outside reporting on similar macOS stealers suggest `sn_relay` may support browser-session interception, live browser control, or traffic relaying tied to credential theft and crypto-wallet abuse. Some secondary reporting has speculated it could help with browser hijacking or man-in-the-middle style activity, especially because MacSync operators can already deploy browser extensions, replace wallet apps, and run remote AppleScript. Still, that remains informed speculation, not a confirmed finding. The strongest factual answer is that `sn_relay` appears to be an additional on-demand module fetched for a browser-related operation, but its exact role has not yet been established publicly by researchers.

1 articles · Updated · Fox News · Oct 4

Kaspersky found a September 2026 MacSync variant that pulls commands from a public iCloud calendar event, then uses them to fetch another malicious app from iCloud.
The calendar event does not infect Macs by itself; the attack starts after a user runs a malicious app, letting attackers hide later-stage activity behind trusted Apple infrastructure.
MacSync is an information stealer that can grab browser passwords, cookies, Keychain data, Telegram information, crypto wallet files and developer credentials including SSH, AWS, Kubernetes and Git configurations.
A separate Objective-C backdoor masquerades as Finder, persists through LaunchAgent, .zshrc and Git-hook changes, and can suppress some macOS notifications while taking remote commands.
Researchers also traced MacSync to a fake Toria crypto wallet promoted on X and Telegram, underscoring Apple's warning to avoid untrusted downloads, pasted Terminal commands and outdated macOS systems.