Researchers found macOS infostealer malware delivered through a fake CAPTCHA-style pop-up that convinces users to copy and paste a long command into the Terminal. The command downloads and runs a loader that steals browser passwords, Apple Keychain data, and can even drain cryptocurrency wallets to attacker-controlled addresses. Huntress links the hosting and command-and-control infrastructure to Aeza Group, a sanctioned Russian “bulletproof” hosting provider tied to cybercrime.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
On your Mac, a website suddenly shows a CAPTCHA-style popup that says: copy this long command into Terminal to fix access. This is a ClickFix attack. That command secretly downloads a Mac loader, then a Go-based stealer that raids your browser passwords, Apple Keychain, and even checks your crypto wallets to drain them. Here’s the aha: no real CAPTCHA or website verification ever needs you to open Terminal. If a site tells you to copy a long command, treat it like someone asking for your bank PIN. If you ever did paste a command from a website into Terminal, stop using that Mac and call IT immediately so they can isolate it before anything else is stolen.
Researchers reported real-world ClickFix social engineering lures that trick macOS users into pasting a command into Terminal, which then installs a password- and keychain-stealing malware. The malware can also “slowly deplete” cryptocurrency wallets by redirecting funds to attacker-controlled…
Attackers are tricking Minecraft players into downloading malware by cloning legitimate mod/client websites and manipulating search results so the malicious pages appear highly ranked. Even after the malware’s command-and-control systems were disrupted, the fake sites and trusted file-hosting links…
Attackers linked to North Korea reportedly used a fake recruiting process to trick a Binance software engineer into downloading and running a malicious code repository during a supposed job assessment. The compromise ultimately helped the attackers access Binance’s wallet systems and steal about…
Russia-aligned Gorbag has targeted Ukrainian government, justice, defense, and logistics organizations with convincing spearphishing emails. The group used a compromised local-government email account to send a fake administrative-fines notice with a malicious Excel attachment, then shifted to…
Russia-aligned group Gorbag targeted Ukrainian public-sector and defense organizations with spearphishing emails disguised as administrative fines and tax matters. The messages delivered malicious files that stole browser passwords, VPN settings, documents, and electronic-signature keys,…
Attackers sent Korean-language emails posing as FedEx tax invoices to pressure billing and payment staff into opening a ZIP attachment. The attachment contains a blank-looking PDF that asks the recipient to approve a security prompt, allowing hidden commands to launch malware on Windows.
