But now, it looks like these threat actor have shifted their attention to Mac users, through a campaign known as ClearFake. Earlier, the researchers had noticed a pattern with these threat actors, where they distributed AMOS to unsuspecting users via infected software updates, cracks, or key gens, and when the user downloaded and ran these items, the maware would activate.
