{"id":3465,"date":"2026-03-16T11:41:00","date_gmt":"2026-03-16T11:41:00","guid":{"rendered":"https:\/\/infosec-daily.com\/?page_id=3465"},"modified":"2026-03-16T11:41:00","modified_gmt":"2026-03-16T11:41:00","slug":"clickfix-campaigns-spread-macsync-macos-infostealer-via-fake-ai-tool-installers","status":"publish","type":"page","link":"https:\/\/infosec-daily.com\/?page_id=3465","title":{"rendered":"ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers"},"content":{"rendered":"<p>Three different ClickFix campaigns have been found to act as a delivery vector for the deployment of a macOS information stealer called MacSync.<br \/>\n&#8220;Unlike traditional exploit-based attacks, this method relies entirely on user interaction \u2013 usually in the form of copying and executing commands \u2013 making it particularly effective against users who may not appreciate the implications of running<\/p>","protected":false},"excerpt":{"rendered":"<p>Three different ClickFix campaigns have been found to act as a delivery vector for the deployment of a macOS information stealer called MacSync. &#8220;Unlike traditional exploit-based attacks, this method relies&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3466,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"saved_in_kubio":false,"footnotes":""},"class_list":["post-3465","page","type-page","status-publish","has-post-thumbnail","hentry"],"kubio_ai_page_context":{"short_desc":"","purpose":"general"},"_links":{"self":[{"href":"https:\/\/infosec-daily.com\/index.php?rest_route=\/wp\/v2\/pages\/3465","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec-daily.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/infosec-daily.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/infosec-daily.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec-daily.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3465"}],"version-history":[{"count":0,"href":"https:\/\/infosec-daily.com\/index.php?rest_route=\/wp\/v2\/pages\/3465\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/infosec-daily.com\/index.php?rest_route=\/wp\/v2\/media\/3466"}],"wp:attachment":[{"href":"https:\/\/infosec-daily.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3465"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}