ClickFix Social Engineering Campaigns Using Terminal Commands to Install Stealers

Multiple reports highlighted ClickFix-style social engineering that convinces users to paste attacker-supplied commands into a terminal, leading to infostealer installation. Malwarebytes documented a macOS lure impersonating CleanMyMac via cleanmymacos[.]org, where victims are instructed to run a Terminal command that prints a reassuring message, decodes a hidden (base64) destination, and then downloads and executes a remote shell script via zsh. The resulting payload installs SHub Stealer, which targets saved passwords, browser data, Apple Keychain contents, Telegram sessions, and cryptocurrency wallets; it can also tamper with wallet applications (e.g., Exodus, Atomic Wallet, Ledger Live) to enable later theft of recovery phrases.

Microsoft threat intelligence (as reported by The Hacker News) described a parallel Windows ClickFix campaign that shifts from the traditional Run-dialog paste to Windows Terminal (wt.exe) using the Win + X → I shortcut, exploiting the tool’s administrative legitimacy to reduce suspicion and evade detections tuned to Run-dialog abuse. In that chain, users paste a hex-encoded/XOR-compressed command that spawns additional Terminal/PowerShell stages to decode scripts, download a ZIP payload plus a legitimate-but-renamed 7-Zip binary, extract additional components, establish persistence via scheduled tasks, configure Microsoft Defender exclusions, and ultimately deploy Lumma Stealer (including use of QueueUserAPC() for injection).