Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the malware. After stealing credentials and app/browser data, a second stage can remotely control a hidden copy of the victim’s browser session to capture cookies and live activity.
This campaign relies on a counterfeit GitHub download page that presents a Terminal installation box, framed as a convenience feature for advanced users. Numbered instructions guide the victim to open Terminal and install something. Clicking the page's copy button places a base64-encoded blob on the clipboard, which decodes into a single command. When the victim pastes and runs it in Terminal, a short, silent, self-deleting script downloads and executes the AmnesiaStealer binary. The malware then prompts the victim to enter their password and harvests data from sources including Apple Notes and Telegram. A second stage goes further, enabling remote and hidden control of a cloned browser profile across Chromium-family browsers, complete with live screencast and input control, plus plaintext cookie theft via the DevTools protocol.
The attack succeeds because it exploits a classic ClickFix pattern: a fake error or verification message manipulates the victim into copying and pasting a malicious script and running it themselves. Because the user enters the command manually, many antivirus and cyber defense tools categorize the action as legitimate user activity, letting the malware bypass security protections since the victim effectively infects themselves. The tactic also preys on users' natural desire to fix problems on their own rather than alerting IT, which discourages verification or reporting before damage is done.
Organizations should reinforce that legitimate installations rarely require pasting opaque commands into Terminal, and that any such request warrants pausing and verifying with IT before proceeding. Since this technique targets the instinct to self-resolve technical issues, awareness efforts should explicitly encourage reporting suspicious install prompts, especially on macOS, to reduce the chance that a single pasted command leads to credential and cookie theft across browsers and apps.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ClickFix is a social engineering method where a fake error or verification message convinces a user to copy and paste a malicious script into their own Terminal and run it, making the action look self-initiated rather than an attack.
The counterfeit GitHub download page shows a Terminal installation box framed as a convenience feature, and clicking its copy button places a base64-encoded command on the clipboard that, when pasted and run, downloads and executes AmnesiaStealer.
It prompts the victim to enter their password and then collects data from sources including Apple Notes and Telegram, and a second stage can steal browser cookies in plaintext and remotely control a cloned browser session.
Because the user manually enters and runs the command themselves, many antivirus and cyber defense tools categorize the action as legitimate user activity rather than a malicious process.
On your Mac, a page that looks like GitHub pops up: “Terminal installation for advanced users.” Copy, paste, fix it yourself. This is a real ClickFix scam pushing macOS AmnesiaStealer. When you hit copy, it drops a base64 blob on your clipboard, then a silent script pulls down the malware and asks for your Mac password. From there, AmnesiaStealer can raid Apple Notes and Telegram, then spin up a hidden Chromium browser profile it can remote-control, live-screencast, and strip cookies in plaintext, like someone driving your browser behind your back. Aha moment: any site or email that tells you to copy and paste a command into Terminal to ‘fix’ or ‘verify’ something is a stop sign. Do not run it, screenshot it and send it to IT.
Researchers reported a real phishing campaign (“Operation BlueDash”) that tricks users with a “secure document” lure and routes them to a fake Microsoft Store page that claims Microsoft Teams must be updated. The download installs legitimate remote access tools (Level RMM and ScreenConnect) so…
Microsoft tracked a real macOS ClickFix campaign using 250+ domains that fingerprint visitors to hide malicious pages from security scanners. Selected Mac users are shown a fake “Download for macOS” lure and prompted to copy/paste an obfuscated command into Terminal, which then pulls down scripts…
Researchers describe AmnesiaStealer, a macOS infostealer spread via a convincing fake GitHub download page that tricks users into pasting a Terminal command. After installation, it uses an “Installer”-style password prompt to capture the Mac login password, steal browser and keychain data, and can…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Researchers observed a real macOS information-stealing campaign that tricks victims into pasting a command into Terminal from a “ClickFix” web page. After running, the malware shows a fake macOS password prompt and can repeatedly crash key apps (Finder/Dock/browsers) for hours or days to pressure…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
