Click Fix Campaign: MacSync Infostealer Delivery

**MacOS-targeting malware campaign:** The report outlines an active campaign delivering a macOS binary via scripted (base64-encoded curl) downloads from a large set of domains (81 unique domains) with a documented registration timeline and TLD shifts, provides a SHA256 hash (2ee9dcc392f999449cc8ba4a1304e993b8665c33561f3063f96e22e2b896dde4) and recommended detection/mitigation actions (block domains, hunt logs for curl/base64 patterns, monitor new .sbs/.cfld registrations).