ClickFix MacSync social-engineering campaign targeting macOS users
Campaign
Summary
Hide ▲
Show ▼
ClickFix campaigns continued to blend fake verification pages with command-pasting lures, including a 2025-11-06 wave that used embedded video tutorials, automatic OS detection, a one-minute countdown timer, and Google Search malvertising. Later reporting said a November 2025 macOS lure used OpenAI Atlas bait from Google sponsored results to send victims to a fake Google Sites page that asked them to paste a Terminal command. That first wave downloaded a shell script that requested the system password and launched MacSync with user-level permissions, putting credentials, files, keychain databases, and crypto-wallet seed phrases at risk.
Related Happenings
WordPress malware campaign using Steam profile C2 concealment
Campaign
H score37
First: 01.06.2026 20:04
Last: 01.06.2026 20:04
Sources 1
About this happening:
A WordPress malware campaign has infected about 1,980 websites since July 2025, and it hides command-and-control (C2) data in Steam Community profile comments...
WordPress malware campaign using Steam profile C2 concealment
CampaignAbout this happening: A WordPress malware campaign has infected about 1,980 websites since July 2025, and it hides command-and-control (C2) data in Steam Community profile comments...
Vidar Stealer ClickFix campaign targeting multiple sectors
Campaign
H score38
First: 08.05.2026 14:00
Last: 08.05.2026 14:00
Sources 1
About this happening:
The Vidar Stealer campaign is using ClickFix social engineering and compromised WordPress sites to deliver password-stealing malware, widening risk for infrastructur...
Vidar Stealer ClickFix campaign targeting multiple sectors
CampaignAbout this happening: The Vidar Stealer campaign is using ClickFix social engineering and compromised WordPress sites to deliver password-stealing malware, widening risk for infrastructur...
ACSC ClickFix mitigation guidance for Vidar Stealer
Advisory/Mitigation
H score34
First: 07.05.2026 21:00
Last: 07.05.2026 21:00
Sources 1
About this happening:
The ACSC issued mitigation guidance for an ongoing ClickFix campaign that is pushing Vidar Stealer through malicious PowerShell commands, increasing credential-the...
ACSC ClickFix mitigation guidance for Vidar Stealer
Advisory/MitigationAbout this happening: The ACSC issued mitigation guidance for an ongoing ClickFix campaign that is pushing Vidar Stealer through malicious PowerShell commands, increasing credential-the...
Atomic Stealer (AMOS) macOS ClickFix Script Editor activity
Malware Activity
H score30
First: 09.04.2026 14:20
Last: 09.04.2026 14:20
Sources 1
About this happening:
A macOS malware campaign has shifted its ClickFix execution flow to Script Editor, helping Atomic Stealer (AMOS) avoid the usual Terminal warning path. The cha...
Atomic Stealer (AMOS) macOS ClickFix Script Editor activity
Malware ActivityAbout this happening: A macOS malware campaign has shifted its ClickFix execution flow to Script Editor, helping Atomic Stealer (AMOS) avoid the usual Terminal warning path. The cha...
Atomic Stealer macOS Script Editor ClickFix campaign
Campaign
H score42
First: 08.04.2026 21:55
Last: 08.04.2026 21:55
Sources 1
About this happening:
A new Atomic Stealer (AMOS) campaign is targeting macOS users through fake Apple-themed cleanup sites, creating a lower-friction path to malware installation and data...
Atomic Stealer macOS Script Editor ClickFix campaign
CampaignAbout this happening: A new Atomic Stealer (AMOS) campaign is targeting macOS users through fake Apple-themed cleanup sites, creating a lower-friction path to malware installation and data...
Timeline
-
16.03.2026 13:41 2 articles · 4mo ago
ClickFix MacSync social-engineering campaign targeting macOS users
Initial DisclosureIn November 2025, a ClickFix lure used OpenAI Atlas bait from Google sponsored results to route victims to a fake Google Sites page that instructed them to paste a Terminal command. That first wave downloaded a shell script that requested the system password and launched MacSync with user-level permissions.
Show sources
- ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers — thehackernews.com — 16.03.2026 13:41
- ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers — thehackernews.com — 16.03.2026 13:41
-
06.11.2025 16:00 1 articles · 8mo ago
ClickFix campaign adds video tutorials and OS-aware lures
Campaign Scope UpdatePush Security identified recent ClickFix campaigns that use embedded video tutorials, automatic OS detection, a one-minute countdown timer, and fake Cloudflare CAPTCHA verification challenges to pressure victims into pasting malicious commands; the delivery is also promoted through malvertizing on Google Search and can inject OS-specific payloads such as MSHTA on Windows and PowerShell scripts on other systems.
Show sources
- ClickFix malware attacks evolve with multi-OS support, video tutorials — www.bleepingcomputer.com — 06.11.2025 16:00