ClickFix Malware Targets macOS With Fake Disk Cleanup Utilities

Key Takeaways

• A new macOS malware campaign, dubbed “ClickFix,” leverages fake disk cleanup and system utility lures to trick users into executing malicious commands.
• The campaign bypasses Apple’s Gatekeeper security by instructing users to paste commands directly into Terminal, leading to the silent installation of infostealers.
• ClickFix aims to steal highly sensitive data, including iCloud credentials, browser passwords, cryptocurrency wallet keys, and can even replace legitimate crypto apps with malicious versions.
• Microsoft researchers have been tracking three distinct ClickFix campaign types since January 2026, all focused on data exfiltration and persistent system access.
• Apple has updated XProtect signatures and introduced a paste-blocking prompt in macOS 26.4 to mitigate this threat, but user vigilance remains paramount.

A sophisticated new cyberattack campaign, named ClickFix, is actively targeting macOS users by masquerading as legitimate system maintenance tools. Threat actors behind ClickFix are exploiting user trust in system utilities and common troubleshooting advice to deploy infostealers and establish persistent access on compromised machines. This tactic involves tricking users into manually executing dangerous commands directly within their Terminal application, a method that circumvents standard macOS security features.

Researchers at Microsoft have been closely monitoring the evolution of this threat since at least January 2026. Their analysis reveals three distinct campaign variations, all sharing the overarching objective of stealing sensitive data, maintaining control over infected systems, and exfiltrating a wide array of personal information, including saved passwords, browser credentials, cryptocurrency wallet keys, and iCloud data.

A critical aspect of the ClickFix campaign’s effectiveness lies in its ability to bypass Apple’s built-in security mechanisms. macOS typically employs Gatekeeper, a security feature designed to verify applications before they are launched. However, when users are instructed to paste and execute commands directly into the Terminal, this verification process is entirely bypassed, providing attackers with a direct and low-friction pathway to compromise devices.

The scope of data exfiltration is extensive and deeply personal. Depending on the specific variant of the ClickFix malware that infects a system, attackers can harvest iCloud account information, stored browser passwords, Keychain entries, personal media files, Telegram data, and cryptocurrency wallet details. In some particularly insidious instances, the malware goes further by replacing legitimate cryptocurrency wallet applications such as Trezor Suite, Ledger Live, and Exodus with fake, attacker-controlled versions. These fraudulent applications are designed to silently intercept and reroute all future transactions, leading to significant financial losses for victims.

How the Fake Utility Lures Work

The initial lures employed in the ClickFix campaign are meticulously designed to appear as authentic support content. Fake blog posts, hosted on platforms like Medium (e.g., macos-disk-space[.]medium[.]com) and Craft (e.g., macclean[.]craft[.]me), mimic genuine macOS troubleshooting guides. These deceptive posts instruct users to copy and paste specific commands into their Terminal to “resolve” common macOS issues, such as low disk space. Similar fraudulent pages have also been observed on standalone websites with seemingly official and trustworthy domain names.

Once the user executes the provided Terminal command, a hidden script is decoded and initiates a multi-stage infection process. In the “loader” campaign variant, a shell script first performs system fingerprinting, gathering details like keyboard locale and operating system version, before establishing communication with an attacker-controlled command-and-control (C2) server.

The “script” campaign variant sees the malware actively searching for a live C2 server. If direct communication fails, it employs a Telegram bot as a fallback mechanism to dynamically locate an operational C2. The “helper” campaign, on the other hand, deploys a concealed executable, typically named “helper” or “update,” which establishes a persistent backdoor on the system, ensuring it launches silently with every device restart.

Infostealer Payloads and Persistence

Microsoft researchers have confirmed the deployment of three distinct infostealer families within the ClickFix campaign: Macsync, Shub Stealer, and AMOS. Upon successful infiltration, these infostealers follow a similar operational procedure. They typically prompt the user to enter their macOS password under the guise of requiring administrative permissions to complete a utility installation. After capturing and validating the password, the malware proceeds to harvest sensitive data from various locations across the machine.

To ensure persistence across system reboots, the ClickFix campaigns leverage macOS LaunchAgents and LaunchDaemons. These are legitimate background processes designed to start automatically when the system boots. One campaign variant cleverly disguises its persistence component as a Google software update agent, utilizing a plist file named com.google.keystone.agent.plist to blend in with legitimate system processes. The “helper” campaign takes this a step further by deploying a hidden backdoor named .mainhelper, complemented by a supervisor script called .agent, which automatically relaunches the backdoor if its process is terminated.

In response to this threat, Apple has updated its XProtect signatures to detect ClickFix malware. Furthermore, macOS 26.4 introduced a new paste-blocking prompt. This security feature warns users when a potentially malicious command is about to be pasted into Terminal, providing an additional layer of defense against such social engineering tactics.

What You Should Do

• Never Paste Unknown Commands: Absolutely refrain from copying and pasting commands from untrusted or unverified online sources directly into your Terminal application.
• Verify Sources: Always verify the legitimacy of any troubleshooting guide or utility recommendation. Stick to official Apple support documentation or reputable software vendors.
• Enable Paste Blocking: Ensure your macOS is updated to version 26.4 or later to benefit from the new paste-blocking prompt in Terminal.
• Monitor for Suspicious Activity: For security teams, monitor for unusual curl activity, flag command sequences involving osascript, Base64 decoding, and Gunzip, and detect unauthorized access attempts to Keychain data and browser credential stores.
• Use Reputable Security Software: Employ robust antivirus and anti-malware solutions that specifically support macOS to detect and block known threats.
• Regularly Backup Data: Maintain regular backups of critical data to an external or cloud-based storage solution.
• Educate Users: Conduct ongoing cybersecurity awareness training for all users, emphasizing the dangers of social engineering and the importance of scrutinizing online instructions.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.