Researchers found macOS infostealer malware delivered through a fake CAPTCHA-style pop-up that convinces users to copy and paste a long command into the Terminal. The command downloads and runs a loader that steals browser passwords, Apple Keychain data, and can even drain cryptocurrency wallets to attacker-controlled addresses. Huntress links the hosting and command-and-control infrastructure to Aeza Group, a sanctioned Russian “bulletproof” hosting provider tied to cybercrime.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
On your Mac, a website suddenly shows a CAPTCHA-style popup that says: copy this long command into Terminal to fix access. This is a ClickFix attack. That command secretly downloads a Mac loader, then a Go-based stealer that raids your browser passwords, Apple Keychain, and even checks your crypto wallets to drain them. Here’s the aha: no real CAPTCHA or website verification ever needs you to open Terminal. If a site tells you to copy a long command, treat it like someone asking for your bank PIN. If you ever did paste a command from a website into Terminal, stop using that Mac and call IT immediately so they can isolate it before anything else is stolen.
Researchers reported real-world ClickFix social engineering lures that trick macOS users into pasting a command into Terminal, which then installs a password- and keychain-stealing malware. The malware can also “slowly deplete” cryptocurrency wallets by redirecting funds to attacker-controlled…
Attackers are tricking Minecraft players into downloading malware by cloning legitimate mod/client websites and manipulating search results so the malicious pages appear highly ranked. Even after the malware’s command-and-control systems were disrupted, the fake sites and trusted file-hosting links…
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
Researchers report that the WeedHack malware campaign is still infecting people through convincing fake Minecraft client/mod websites, even after its command-and-control server was disrupted. Attackers use SEO poisoning and trusted community platforms (like Discord and Minecraft modding sites) to…
Researchers describe AmnesiaStealer, a macOS infostealer spread via a convincing fake GitHub download page that tricks users into pasting a Terminal command. After installation, it uses an “Installer”-style password prompt to capture the Mac login password, steal browser and keychain data, and can…
The article describes how attackers can manipulate autonomous AI agents using “prompt injection,” including a Mozilla-tested proof-of-concept that hid malicious instructions inside an ordinary-looking code repository. When a developer’s AI coding agent processed and executed those instructions, it…
