Attackers can abuse URL requests processed by an email program for Mac to steal files from the victim — sometimes without user interaction.
Source: Threadpost