A verified X ad and a routine browser habit are being used to hijack Mac users and Microsoft 365 accounts alike. Here’s ...