Microsoft tracked a real macOS ClickFix campaign using 250+ domains that fingerprint visitors to hide malicious pages from security scanners. Selected Mac users are shown a fake “Download for macOS” lure and prompted to copy/paste an obfuscated command into Terminal, which then pulls down scripts and installs an infostealer (AMOS) to steal credentials and sensitive data.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
On your Mac, you click a link and land on a slick GitHub-style page: big blue button, “Download for macOS.” Looks totally legit. Behind the scenes, ClickFix is fingerprinting you. If you look like a real Mac user, it shows a forged “Verified Publisher” badge and tells you: copy this weird command into Terminal to continue. Here’s the trap: that one pasted command quietly pulls down more scripts and launches Atomic Stealer, ripping passwords, browser data, even crypto wallets off your Mac. Aha rule: any website that tells you to paste a command into Terminal? Stop. Close the tab. Then report it to security and say you hit a fake macOS download asking for Terminal.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Iran-aligned DarkBlinders used convincing recruitment offers while posing as Dubai Airports recruiters to target a high-value job seeker in Iraq. The victim was asked to complete what appeared to be a coding assessment, but the assessment package installed malware. The group also used lookalike…
Researchers demonstrated that malicious web pages and local previews can abuse embedded browsers in popular AI coding assistants. The attacks can hide instructions from users, spoof trusted login addresses, or access sensitive files, creating realistic risks for developers who open untrusted links…
Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…
