ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers

A series of widespread ClickFix/InstallFix campaigns use malicious search ads, compromised and legitimate hosting platforms, and social-engineered terminal/PowerShell paste commands to deploy macOS and Windows infostealers (e.g., MacSync, Alien, Atomic). Campaigns employ sophisticated evasion (in-memory AppleScript payloads, obfuscated loaders), target developer/macOS users to harvest credentials, keychains, and crypto seed phrases, and leverage TDS/infected WordPress sites to scale distribution across multiple countries.