ClickFix Campaign Targets macOS Users, Delivering Infostealers Through Social Engineering Tactics

A significant shift in the cybersecurity landscape has emerged as the ClickFix campaign, initially a concern for Windows users, has expanded its reach to macOS. According to a recent analysis by Microsoft’s Defender Security Research Team, this campaign has been actively targeting macOS users since at least January 2026. The primary objective is to deliver infostealers by manipulating users into executing malicious commands in their Terminal, disguised as routine system maintenance tasks.

Understanding ClickFix: A New Era of Social Engineering

ClickFix represents a sophisticated social engineering technique that circumvents traditional malware delivery methods. Instead of exploiting vulnerabilities or compromising download links, attackers present a fabricated issue—such as a disk space alert or a system error—and instruct users to copy and paste a command into their Terminal to resolve the problem. This method effectively turns the user into an unwitting installer of malware, eliminating the need for exploits, drive-by downloads, or suspicious attachments.

Microsoft has observed that threat actors are strategically seeding these malicious commands across various blog sites and user-driven content platforms where individuals seek macOS advice. The pages appear credible, and the instructions seem legitimate. However, when users execute the commands, they inadvertently install one of three infostealers: Macsync, Shub Stealer, or Atomic macOS Stealer (AMOS).

Mechanisms of the Campaign

Since February 2026, one variant of the ClickFix campaign has utilized the curl command to pull a loader shell from the attackers’ infrastructure immediately upon execution of the ClickFix command. This loader, a zsh script—macOS’s default shell—decodes and decompresses an embedded payload using Base64 and Gzip before executing it in memory.

Before any payload is delivered, the script conducts a critical environmental check. It scans for Russian and CIS-region keyboard layouts on the device. If detected, it triggers a cis_blocked event to the attacker’s server and halts execution. This serves as a deliberate kill switch to avoid infecting operators’ compatriots or triggering sandbox environments operated by CIS-based security researchers.

A second variant, active since late January 2026, employs a macOS executable named “helper” or “update” instead of a shell loader. A first-stage script decodes a Base64 payload, decompresses it using Gunzip, and drops a malicious Mach-O binary—native macOS executable code—into /tmp/helper or /tmp/update. To evade macOS security warnings, the binary has its extended attributes removed prior to execution. The infection chain employs an AppleScript-based stager with array subtraction obfuscation to conceal its strings and commands from static analysis.

The Data at Risk

Once installed, the three infostealer families target a range of sensitive data, including media files, iCloud data, Keychain entries—Apple’s built-in credential management system—and cryptocurrency wallet keys. In some instances, the malware goes further by replacing legitimate cryptocurrency wallet applications on the victim’s device with trojanized versions. This tactic embeds persistent access that survives beyond the initial infection window, activating upon the user’s next interaction with their wallet.

The macOS Assumption Problem

The ongoing investment in macOS-targeted ClickFix campaigns underscores a calculated strategy recognized by security researchers through early 2026. macOS users are often associated with higher-value credential profiles. Developer machines predominantly run on Macs, and professionals in cloud engineering, finance, and cryptocurrency are more likely to use macOS. Consequently, AWS credentials, SSH keys, Kubernetes configuration files, crypto seed phrases, and corporate SSO sessions are stored in Keychain or browser credential stores on these devices. AMOS, MacSync, and Shub Stealer are specifically designed to harvest this sensitive data.

Between February and March 2026, at least 20 distinct malware campaigns targeted AI and developer tools, with nine targeting both Windows and macOS, and seven focusing exclusively on macOS.

Apple’s Response and Limitations

In response to the rising threat, Apple introduced a Terminal security warning in macOS Tahoe 26.4 that alerts users when they attempt to paste potentially suspicious commands. However, attackers have already adapted their tactics. Jamf Threat Labs documented a variant that routes execution through macOS Script Editor via the applescript:// URL scheme, effectively bypassing the new warning. Users on older operating system versions, as well as those who dismiss the warning, remain vulnerable.

Microsoft recommends monitoring for Terminal activity involving curl, Base64 decoding, gunzip, osascript, or JavaScript for Automation invocations. Security professionals should treat any unsigned DMG or unofficial “terminal fix” utility as high-risk. Organizations are advised to implement custom detection rules that cover abnormal Keychain access, browser credential store queries, and cloud credential file reads.

For further insights into the evolving landscape of cybersecurity threats, refer to the original reporting source: thecyberexpress.com.

Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.