What this "OBS Studio" is really doing?

A fake OBS Studio website served via Bing Ads delivers malware that silently installs ScreenConnect (a remote management tool) alongside the real OBS installer to avoid suspicion, while also establishing registry persistence. The Windows payload is stealthy enough that a casual user would likely not notice. The Mac version of the same malware is far less stealthy due to macOS Gatekeeper and permission prompts. A second Mac-targeting payload is also analyzed — a crypto scam that exfiltrates the user's keychain database. Key takeaway: Windows malware has equal-privilege access to all running programs, while macOS requires elevation tricks or exploits, offering some security advantage but not immunity.