Microsoft Threat Intelligence tracked a real macOS “ClickFix” campaign that uses look‑alike domains to trick Mac users into copying and running a Terminal command. The operation now hides the malicious “Download for macOS” lure behind server-side browser fingerprinting, showing benign decoy pages to scanners and non‑Mac visitors while delivering infostealers like Atomic Stealer (AMOS) to likely Mac targets.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
On your Mac, you hit a site that says “Verified Publisher – Download for macOS”… and asks you to run a Terminal command. This is ClickFix: a Mac scam where sites like apricotfilepoint dot com trick you into copying a curl one‑liner into Terminal, silently dropping infostealers like Atomic Stealer and MacSync. The aha: a legit Mac app does NOT need you to paste mystery commands into Terminal to ‘complete the download’, that’s the ClickFix tell, no matter how shiny the page or badge looks. If any download page tells you to copy a Terminal command, stop. Don’t run it, report the site to Security, then get the app only from the official vendor or App Store.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Ukraine’s CERT says the Russia-linked Sandworm group is tricking targets into infecting their own PCs using compromised websites that display fake CAPTCHA checks. Victims are instructed to copy and paste a PowerShell command, which downloads malware and can lead to deeper compromise. CERT also…
This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page…
