Loading story…
Threat actors are expanding ClickFix-style social engineering beyond simple “copy/paste this command” lures, including a campaign that abuses Pastebin comments to push victims toward executing attacker-supplied JavaScript in their browser to hijack cryptocurrency swap flows. The Pastebin comments promote a fake “Swapzone.io arbitrage exploit” and route users through a rawtext[.]host link to a Google Doc (“Swapzone.io – ChangeNOW Profit Method”) that instructs users to run JavaScript which can modify the swap process in-session and redirect funds to attacker-controlled wallets; the reporting notes this may be an early example of ClickFix being used to directly alter webpage functionality for theft.
Separately, Objective-See documented ClickFix as a rapidly growing infection technique on macOS and Windows that relies on persuading users to paste attacker-controlled commands into a terminal, enabling execution without exploiting software vulnerabilities and potentially bypassing macOS protections such as Gatekeeper and Notarization. The post describes a practical macOS-focused mitigation that intervenes at “paste time” to disrupt many ClickFix attempts, implemented in BlockBlock, while also outlining limitations and potential bypasses—reinforcing that ClickFix is primarily a user-manipulation problem that defenders should address with both technical controls and user-execution friction.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer analyzed the campaign and reported that the first-stage JavaScript loads an obfuscated second-stage payload from rawtext[.]host, which overrides Swapzone's legitimate swap-handling logic. The report described the activity as a notable ClickFix-style campaign using in-browser JavaScript to alter webpage functionality for cryptocurrency theft.
Threat actors began abusing Pastebin comments to lure cryptocurrency users with supposed Swapzone/ChangeNOW arbitrage documentation, directing them to a Google Doc that instructs victims to run malicious JavaScript in their browser. The payload injects code into Swapzone sessions to replace legitimate Bitcoin deposit addresses with attacker-controlled wallets and manipulate displayed swap details.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are increasingly compromising macOS systems through **ClickFix** and related social-engineering lures that trick users into pasting malicious commands into Terminal, often behind fake Cloudflare checks, bogus troubleshooting steps, fraudulent support messages, or compromised websites. A large campaign tied to hundreds of hacked WordPress sites served platform-specific payloads and used the **Polygon** blockchain to hide command-and-control locations, while the macOS payload ran largely in memory, harvested Keychain data, browser information, SSH keys, screenshots, and other files, then staged stolen data in `/tmp/osalogging.zip` before exfiltrating it. Researchers said the technique does not rely on a macOS software flaw, but on convincing victims to execute attacker-supplied commands themselves. Threat reporting indicates the tactic has become a dominant initial-access method against Mac users, especially cryptocurrency holders and developers, and that recent Apple paste warnings in Terminal have already been bypassed through Script Editor abuse. Separate intrusion research linked cryptocurrency-focused activity to malware families including **DEEPBREATH**, **SUGARLOADER**, and **CHROMEPUSH**, showing how post-compromise tooling on macOS can escalate from social engineering to broad credential and data theft by targeting `TCC.db`, Keychain contents, Chromium-based browsers, Telegram data, and Apple Notes. Security teams are being urged to prioritize behavioral detection, cross-platform response, and user controls that prevent unverified command execution on Macs.
Jul 16, 2026
Security researchers report that **ClickFix** has become a major initial-access technique, relying on social engineering rather than software exploits to trick users into pasting attacker-provided commands into **Windows Run** or **macOS Terminal**. ESET said detections rose **108%** from H2 2025 to H1 2026, while RH-ISAC described a broader **517%** increase from late 2024 into the first half of 2025 and noted that Microsoft saw the method in **47%** of initial-access cases handled by Defender Experts. Attackers have expanded ClickFix beyond Windows to **macOS**, delivered it through compromised **WordPress** sites, and improved lures with fake **BSOD** screens, frozen document viewers, and service-specific error messages. The technique is now used by both cybercriminals and state-backed groups, with RH-ISAC linking adoption to **Sandworm, APT28, MuddyWater, and Kimsuky** and citing Sandworm activity against organizations in Ukraine, including at least one compromise involving **FreakyPoll** malware. Researchers also observed ClickFix delivering malware such as **ACR Stealer, OkoBot, TELEPUZ, ClickLock Stealer**, and **DriveSurge**, while newer variants including **CrashFix, FileFix, PromptFix, and ConsentFix** show continued evolution. ESET additionally identified an **"AI-fix"** variant that abuses legitimate domains tied to **Anthropic Artifact**, **OpenAI Canvas**, and **Microsoft Copilot Pages** to display fake troubleshooting content for nonexistent AI problems, underscoring how attackers are blending trusted platforms, AI branding, and increasingly industrialized delivery infrastructure.
Jul 20, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026