{"id":30765,"date":"2026-07-27T15:08:58","date_gmt":"2026-07-27T19:08:58","guid":{"rendered":"https:\/\/www.kaspersky.co.uk\/blog\/?p=30765"},"modified":"2026-07-27T20:25:23","modified_gmt":"2026-07-27T19:25:23","slug":"macos-clickfix-attack","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/macos-clickfix-attack\/30765\/","title":{"rendered":"ClickFix on macOS: how Apple users are being scammed"},"content":{"rendered":"

AI is getting better and better at solving CAPTCHAs<\/a>. This makes website creators\u00a0\u2014 who still need to verify that they\u2019re dealing with humans rather than bots\u00a0\u2014 come up with increasingly sophisticated proof-of-humanity checks. It seems an average user would no longer be surprised if asked to recite a poem\u00a0\u2014 or, say, dance Gangnam Style\u00a0\u2014 just to access certain websites. The latter could double as an age check, but I digress.<\/p>\n

Attackers have learned to exploit this variety of sometimes bizarre checks to their advantage. In our blog, we\u2019ve talked more than once about the ClickFix attack technique<\/a>, which is all about slipping a malicious instruction to the victim under the guise of yet another CAPTCHA. Historically, this technique has been used to attack users of Windows-powered devices. However, researchers recently discovered a campaign that targets macOS users. In this post, we talk in more detail about the ClickFix attack technique, the new campaign aimed at Mac users, and the criminals\u2019 goals.<\/p>\n

What is the ClickFix attack technique?<\/h2>\n

Many common attacks and scams rely on social engineering, or more simply put \u2014 manipulation. Instead of looking for software vulnerabilities, attackers try to trick the user into doing the dirty work themselves: opening a malicious file, clicking a link to a fake website, sharing sensitive data, or running a harmful command.<\/p>\n

The simplest example of social engineering is scam calls, where criminals pose as a boss, neighbor, bank security specialist, police officer\u2026 the list goes on almost indefinitely. And if you think that only, let\u2019s say, not-so-smart users fall for these tricks, you\u2019re wrong: social engineering has been used to hack the CIA chief\u2019s email, hijack the X (Twitter) accounts of Elon Musk and Joe Biden, and steal half a billion dollars<\/a>. In our post, They\u2019re reading you like a book: scammers\u2019 favorite tricks<\/strong><\/a>, we take a close look at their favorite techniques\u00a0\u2014 give it a read so you don\u2019t end up sharing company with those famous victims.<\/p>\n

The ClickFix attack also relies on social engineering, except the scammers aren\u2019t betting on the victim\u2019s fear of an authority figure, but rather on their trust in technology and their habit of following instructions\u00a0\u2014 even when they don\u2019t quite make sense.<\/p>\n

In a classic ClickFix scenario, a user visits a compromised or fake website and, instead of the expected page, sees a notification that there\u2019s an issue. The site might claim that to continue, you need to complete an extra verification check, update your browser, or fix an error.<\/p>\n

\"A<\/a>

ClickFix: how to infect your own computer with malware in three easy steps. One of the classic variations of the attack targeting Windows users Source<\/a><\/p><\/div>\n

Next, the victim is prompted to follow a few simple steps that look harmless enough at first glance. Usually, this involves copying some text from the attackers\u2019 website, opening the Run<\/em> window, pasting the text there, and hitting Enter.<\/p>\n

In reality, the text is a malicious command that downloads and runs malware on the device. Since the user carries out all the steps themselves, the operating system\u2019s security mechanisms and built-in warnings are often dismissed as just another part of the instructions. In our blog, we\u2019ve covered the typical pretexts used to trick victims into taking dangerous actions; you can read more about them here<\/a>.<\/p>\n

The ClickFix attack scheme quickly began spawning various spin-offs, such as FileFix<\/a> and ConsentFix<\/a>. Until recently, the victims of ClickFix and its variants were mostly Windows users, while Mac fans encountered it much more rarely<\/a>. But lately, the number of ClickFix attacks targeting Apple device owners has been on the rise.<\/p>\n

How does the ClickFix attack on macOS work?<\/h2>\n

The ClickFix attack on Macs, as documented by cybersecurity researchers, begins with the classic fake CAPTCHA scenario<\/a>. To pass the proof-of-humanity check, attackers prompt the user to copy a command, open Terminal, and paste the text into it.<\/p>\n

\"Malicious<\/a>

The contents of the command that the user is prompted to run via Terminal. Source<\/a><\/p><\/div>\n

The more interesting part is what happens after the malicious command is run. First, it downloads a malicious DMG\u00a0\u2014 the standard format for disk images containing installation files in macOS \u2014 from a remote server, and saves it to the \/tmp<\/em> temporary folder under a random name. Then the script mounts the disk image without showing it in Finder or creating a desktop icon \u2014 keeping it hidden from the user. After that, the script searches the disk image for an app or installation package, and automatically launches it once found.<\/p>\n

One case documented in the researchers\u2019 findings involved the widespread AMOS (Atomic macOS Stealer) infostealer<\/a> being distributed this way. To gain extra privileges on the system, the stealer Trojan displays a fake macOS system authentication window tricking the user into willingly typing in their password.<\/p>\n

What are the attackers\u2019 goals?<\/h2>\n

After the malware is installed, the attackers steal literally everything they can get their hands on from the victim\u2019s device. Atomic macOS Stealer extracts sensitive information stored in Chromium-based browsers (Google Chrome, Microsoft Edge, Brave, Opera, Arc, Vivaldi, CocCoc, and Yandex), as well as Firefox-based ones (LibreWolf, SeaMonkey, Tor Browser, Waterfox, and Zen Browser), such as the following:<\/p>\n