Mac Stealers Shift to ClickFix Delivery

Mac infostealers have adopted ClickFix as their default delivery method, tricking victims into pasting commands into Terminal to bypass Gatekeeper and XProtect. New families like ClickLock, a Go-based stealer, and MacSync now add backdoors and persistence. MacSync pulls commands from a public iCloud calendar, while CrashStealer posed as Apple's crash reporting framework inside a notarized app.