ClickFix campaigns hit macOS with MacSync infostealer through bogus AI downloads
Bogus AI downloads tricked macOS users into pasting Terminal commands that dropped the MacSync infostealer. Sophos tracked 50,000+ clicks in days. A parallel InstallFix variant hits developers because curl | sh is a legitimate pattern.
Read more →