“Double agent”: a MacOS bundleware installer that acts like a spy