From ClickFix to code signed: the quiet shift of MacSync Stealer malware

MacSync Stealer has evolved from user-interaction tricks to a stealthier distribution: a code-signed, notarized Swift dropper packaged in DMGs that fetches and executes an obfuscated shell payload, performs Gatekeeper/quarantine removal, enforces rate-limiting and network checks, and ultimately installs an infostealer; the Jamf Threat Labs report includes detailed behavior, IoCs (hashes, domain, URL, TeamID), and mitigation recommendations.