This website (and paper) outlines a category of attacks targeting Windows, Linux, Android, and MacOS. In general, they revolve around the idea of watching a directory for changes, and receiving notifications about changes for sub-directories and files which the user does not have read access to.