Security researchers are tracking a shift in the ClickFix infostealer campaign targeting macOS users. Instead of distributing malware through application bundles, attackers now host malicious Terminal commands on compromised blogs and content platforms, disguising them as solutions for common system issues.
The attack flow is straightforward: users paste commands into Terminal, which retrieve and execute remotely hosted script loaders. This approach bypasses Apple's Gatekeeper—the code-signing verification that protects against unsigned applications. Scripts launched via `osascript` or shell interpreters skip notarization checks entirely, leaving a gap that ClickFix exploits.
The malware deployed includes Macsync, Shub Stealer, and AMOS, all capable of exfiltrating sensitive data: media files, iCloud credentials stored in Keychain, and cryptocurrency wallet keys. In some cases, attackers replace legitimate crypto wallet applications with trojanized versions.
The scale is significant. Over 700 education and tech websites have been hijacked to distribute ClickFix instructions. Medium hosted posts under domains like `macos-disk-space[.]medium[.]com`, while Craft's note-taking platform served pages like `macclean[.]craft[.]me`—all now removed after being reported.
Earlier versions of ClickFix distributed.dmg files requiring manual installation. The shift to direct command execution reflects attackers optimizing for speed and reducing friction—fewer steps between social engineering and payload execution.
Microsoft has published detection guidance to help users identify and defend against the threat.
