Loading story…
Attackers are increasingly compromising macOS systems through ClickFix and related social-engineering lures that trick users into pasting malicious commands into Terminal, often behind fake Cloudflare checks, bogus troubleshooting steps, fraudulent support messages, or compromised websites. A large campaign tied to hundreds of hacked WordPress sites served platform-specific payloads and used the Polygon blockchain to hide command-and-control locations, while the macOS payload ran largely in memory, harvested Keychain data, browser information, SSH keys, screenshots, and other files, then staged stolen data in /tmp/osalogging.zip before exfiltrating it. Researchers said the technique does not rely on a macOS software flaw, but on convincing victims to execute attacker-supplied commands themselves.
Threat reporting indicates the tactic has become a dominant initial-access method against Mac users, especially cryptocurrency holders and developers, and that recent Apple paste warnings in Terminal have already been bypassed through Script Editor abuse. Separate intrusion research linked cryptocurrency-focused activity to malware families including DEEPBREATH, SUGARLOADER, and CHROMEPUSH, showing how post-compromise tooling on macOS can escalate from social engineering to broad credential and data theft by targeting TCC.db, Keychain contents, Chromium-based browsers, Telegram data, and Apple Notes. Security teams are being urged to prioritize behavioral detection, cross-platform response, and user controls that prevent unverified command execution on Macs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Moonlock reported that by mid-2026, ClickFix had become the dominant initial access technique targeting macOS users, especially cryptocurrency holders and software developers, with attackers reusing tradecraft associated with DPRK-linked operations.
LevelBlue described a broad ClickFix campaign on hundreds of compromised WordPress sites that used fake Cloudflare verification pages to trick macOS users into pasting malicious Terminal commands. The malware ran in memory and used the Polygon blockchain to retrieve command-and-control infrastructure.
A growing social-engineering scam targeting Apple users was reported in which victims are persuaded through phishing, fake support, and fraudulent sites to paste malicious commands into Terminal, enabling malware installation, remote access, data theft, and persistence.
Recent macOS versions introduced safeguards that warn users when pasting commands into Terminal from external sources and block known malicious scripts. These protections were later noted as being bypassed through Script Editor abuse in macOS Tahoe 26.4.
Mandiant described a macOS intrusion attributed to UNC1069 in which DEEPBREATH manipulated the TCC database to gain broad access to sensitive data, while SUGARLOADER was used to deploy the CHROMEPUSH malicious Chromium extension stealer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
moonlock.com
Open sourcelevelblue.com
Open sourcecysecurity.news
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a **ClickFix-style** campaign targeting macOS users that swaps Terminal-based execution for **Script Editor** to bypass newer Apple protections. Victims are lured to fake Apple-themed pages such as “Reclaim disk space on your Mac,” which invoke the `applescript://` URL scheme and open Script Editor with a pre-filled AppleScript. If the user runs it, the script conceals a malicious shell command that decodes a URL, uses `curl` with TLS certificate validation disabled, and pipes the response directly into `zsh` for in-memory execution. The activity, discovered by **Jamf Threat Labs**, ultimately downloads and launches a Mach-O variant of **Atomic Stealer**, an infostealer built to harvest browser credentials, saved passwords, cryptocurrency wallets, and other sensitive data from macOS systems. Researchers said the campaign appears to be an adaptation to Apple’s paste-command scanning protections added in macOS 26.4 for Terminal abuse; while newer macOS versions also warn about unidentified scripts, the attack can still succeed if users follow the prompts. Reported infrastructure tied to the campaign includes `dryvecar.com`, `storage-fixes.squarespace.com`, and `cleanupmac.mssg.me`.
Jun 29, 2026
Threat actors are expanding **ClickFix**-style social engineering beyond simple “copy/paste this command” lures, including a campaign that abuses **Pastebin comments** to push victims toward executing attacker-supplied **JavaScript** in their browser to hijack cryptocurrency swap flows. The Pastebin comments promote a fake “Swapzone.io arbitrage exploit” and route users through a `rawtext[.]host` link to a Google Doc (“Swapzone.io – ChangeNOW Profit Method”) that instructs users to run JavaScript which can modify the swap process in-session and redirect funds to attacker-controlled wallets; the reporting notes this may be an early example of ClickFix being used to directly alter webpage functionality for theft. Separately, Objective-See documented ClickFix as a rapidly growing infection technique on **macOS and Windows** that relies on persuading users to paste attacker-controlled commands into a terminal, enabling execution without exploiting software vulnerabilities and potentially bypassing macOS protections such as **Gatekeeper** and **Notarization**. The post describes a practical macOS-focused mitigation that intervenes at “paste time” to disrupt many ClickFix attempts, implemented in *BlockBlock*, while also outlining limitations and potential bypasses—reinforcing that ClickFix is primarily a user-manipulation problem that defenders should address with both technical controls and user-execution friction.
Jun 29, 2026
Multiple reports highlighted **ClickFix**-style social engineering that convinces users to paste attacker-supplied commands into a terminal, leading to infostealer installation. Malwarebytes documented a macOS lure impersonating *CleanMyMac* via `cleanmymacos[.]org`, where victims are instructed to run a Terminal command that prints a reassuring message, decodes a hidden (base64) destination, and then downloads and executes a remote shell script via `zsh`. The resulting payload installs **SHub Stealer**, which targets saved passwords, browser data, Apple Keychain contents, Telegram sessions, and cryptocurrency wallets; it can also tamper with wallet applications (e.g., *Exodus*, *Atomic Wallet*, *Ledger Live*) to enable later theft of recovery phrases. Microsoft threat intelligence (as reported by The Hacker News) described a parallel **Windows** ClickFix campaign that shifts from the traditional Run-dialog paste to **Windows Terminal** (`wt.exe`) using the `Win + X → I` shortcut, exploiting the tool’s administrative legitimacy to reduce suspicion and evade detections tuned to Run-dialog abuse. In that chain, users paste a hex-encoded/XOR-compressed command that spawns additional Terminal/PowerShell stages to decode scripts, download a ZIP payload plus a legitimate-but-renamed **7-Zip** binary, extract additional components, establish persistence via **scheduled tasks**, configure **Microsoft Defender exclusions**, and ultimately deploy **Lumma Stealer** (including use of `QueueUserAPC()` for injection).
Jun 29, 2026