Microsoft Threat Intelligence tracked a real macOS “ClickFix” campaign that uses look‑alike domains to trick Mac users into copying and running a Terminal command. The operation now hides the malicious “Download for macOS” lure behind server-side browser fingerprinting, showing benign decoy pages to scanners and non‑Mac visitors while delivering infostealers like Atomic Stealer (AMOS) to likely Mac targets.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
On your Mac, you hit a site that says “Verified Publisher – Download for macOS”… and asks you to run a Terminal command. This is ClickFix: a Mac scam where sites like apricotfilepoint dot com trick you into copying a curl one‑liner into Terminal, silently dropping infostealers like Atomic Stealer and MacSync. The aha: a legit Mac app does NOT need you to paste mystery commands into Terminal to ‘complete the download’, that’s the ClickFix tell, no matter how shiny the page or badge looks. If any download page tells you to copy a Terminal command, stop. Don’t run it, report the site to Security, then get the app only from the official vendor or App Store.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
China-aligned threat actor TA419 ran real credential-phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and law firms. The operation used trust-building outreach followed by a shortened link that redirected victims through checks to a fake Microsoft/OneDrive sign-in…
A CTM360 report describes real-world “ClickFix” campaigns where attackers compromise legitimate websites and show fake error/verification messages that trick users into copying a command and pasting it into trusted system tools (Run box, PowerShell, Terminal). This approach avoids traditional…
China-linked actor UTA0565 sent phishing emails that pushed recipients to click spoofed links to fake media/NGO websites. Visiting the sites triggered a Chrome-to-Windows zero-day exploit chain that escaped the browser sandbox and installed CLEANGULP malware for remote control.
Multiple suspected China-linked espionage groups used a new exploit kit (“BlueMoon”) that starts with phishing emails and a malicious link to break into organizations in the US and Southeast Asia. Clicking the link can trigger browser and Windows vulnerabilities to install surveillance tools,…
A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then…
