Fake LumaNotch macOS app =
#NovaStealer (
#MioLab) 🧐
🎭 site = near 1:1 clone of dynamichorizon[.]app
🧾
#ClickFix shows apps[.]apple[.]com, hides the curl|bash
📣 propped up by X/TikTok AI review bait
💀 "killall Terminal" on launch (hides the drop)
🧹 xattr -c → strips quarantine, skips Gatekeeper
🧱 same lineage → build_info_t _g_serialized_build_info
🆕 but config now PBKDF2-HMAC-SHA1 3DES-CBC
↪️ older Nova/MioLab stealer used inline XOR/stream
🌐 open dir → 31.76.93[.]69
🏷️ self-tags "macos-stealer-v2"