ClickFix campaigns hit macOS with MacSync infostealer through bogus AI downloads
by Artem Safonov
Bogus AI downloads tricked macOS users into pasting Terminal commands that dropped the MacSync infostealer. Sophos tracked 50,000+ clicks in days. A parallel InstallFix variant hits developers because curl | sh is a legitimate pattern.
Read more →