Microsoft describes a real macOS data-stealing campaign (MacSync Stealer) that relies on social engineering rather than software exploits. Victims are tricked into pasting/running commands in Terminal, which downloads the payload and ultimately steals passwords, keys, and wallet data, then uploads it in chunks to rotating attacker domains.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
On a Mac and ever seen a website say, “To fix this issue, open Terminal and paste the following command”? That’s the ClickFix trick behind the MacSync Stealer campaign. No exploit, just you pasting a curl command into Terminal that quietly downloads and runs their payload. Once that shell session fires, it hunts for Keychain data, browser passwords and cookies, SSH keys, AWS and Kubernetes configs, even Ledger and Trezor wallet data, then uploads it in chunks to rotating domains. If any website tells you to paste a command into macOS Terminal, stop and send it to IT through our normal support channel before you run anything.
Microsoft reports real-world macOS infections where victims were tricked into pasting commands into Terminal (a “ClickFix”-style social-engineering method). The malware then downloads a payload, steals credentials and other sensitive data (like Keychain and browser sessions), and uploads it in…
Microsoft reports MacSync Stealer infections that start when a user is tricked into pasting or running commands in macOS Terminal (a “ClickFix” style lure). Those commands use built-in tools like curl to download and run the payload, then the stealer collects credentials and sensitive files, stages…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
A real ClickFix campaign used 250+ lookalike domains and browser fingerprinting to show malware lures mainly to real macOS visitors while showing harmless decoys to scanners and researchers. Victims were pushed to copy and run an obfuscated command in macOS Terminal, which then downloaded and…
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Kaspersky reports an active OkoBot malware campaign targeting Windows users who manage cryptocurrency. Victims are lured via “ClickFix” fake-error pages that trick them into running PowerShell commands, and via GitHub repos posing as legitimate software downloads. The malware then steals wallet…
