Dissecting macOS intrusion from lure to compromise