https://thehackernews.com/2025/12/new-macsync-macos-stealer-uses-signed.html
New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper
A new MacSync macOS stealer spreads via a signed, notarized fake installer, bypassing Apple Gatekeeper before Apple revoked the certificate.
newmacsyncmacosstealeruses