Microsoft reports real-world macOS infections where victims were tricked into pasting commands into Terminal (a “ClickFix”-style social-engineering method). The malware then downloads a payload, steals credentials and other sensitive data (like Keychain and browser sessions), and uploads it in chunks, while frequently rotating domains to evade simple blocklists.
MacSync Stealer infections on macOS begin not with a malicious attachment or exploit, but with a simple, direct request: paste a command into Terminal to fix a problem. This is the hallmark of ClickFix, a social-engineering technique where a website or chat message walks a user through steps that end with them running attacker-controlled code themselves. Once pasted, the command uses curl to retrieve a payload through recurring /curl/ paths, then unpacks it using Base64 and gunzip. From there, the malware can invoke osascript to run AppleScript-assisted shell commands, expanding its access on the system.
The attack works because it hands control to the user instead of trying to bypass macOS defenses directly. There is no exploit to detect and no suspicious file to scan, just a person following instructions they believe will solve a technical issue. This is especially effective against developers, IT power users, and other employees comfortable using Terminal, since the request does not look unusual to them the way it might to a less technical user.
Security teams and employees should treat certain behaviors as warning signs regardless of which domain is involved:
Microsoft linked more than 30 domains to this activity by correlating these repeated behaviors, since the malware keeps rotating its web infrastructure. That makes behavior chains, not hostnames, the more reliable signal.
Organizations can reduce risk by training staff, especially developers, to never paste fix commands into Terminal from a website or chat without IT verification, and to report unexpected curl-based install instructions rather than run them. Security operations teams benefit from monitoring for chained activity such as Terminal use followed by osascript, credential access, and chunked uploads, rather than relying on domain blocklists alone. It is also worth reinforcing that a single compromised Mac can expose far more than local files, since stolen browser sessions, SSH keys, and cloud or Kubernetes credentials can provide access well beyond the original device.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ClickFix is a social-engineering technique that tricks users into pasting commands into Terminal to supposedly fix an issue. Microsoft found MacSync Stealer infections began with an interactive zsh Terminal session consistent with this technique.
It targets macOS Keychain material, browser credentials and cookies, SSH keys, AWS credentials, and Kubernetes configurations.
Stolen data is staged under /tmp/sync* paths, compressed into an archive, split into chunks, and sent via HTTP PUT requests using curl with parameters like upload_id and chunk_index.
Microsoft linked more than 30 domains to MacSync Stealer by correlating repeated endpoint and network behaviors, since the malware keeps rotating its web infrastructure.
On your Mac, a help page says: “To fix this issue, open Terminal and paste the following command.” You paste it. Done, right? Behind the scenes, that’s MacSync Stealer. It uses a ClickFix trick: your interactive zsh Terminal session runs a curl command, decodes it with Base64 and gunzip, then even fires osascript to keep going. Now it hunts for macOS Keychain material, browser cookies, SSH keys, AWS creds, even Kubernetes configs. Stolen data piles up under /tmp/sync* and gets chopped into chunks, then sent out with HTTP PUT requests using curl and parameters like upload_id and chunk_index. Here’s the rule: if any website or chat tells you to paste a “fix” command into Terminal, especially one with curl, stop and send it to IT instead of running it.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
A macOS info-stealing malware called ClickLock Stealer uses a fake “Cloudflare verification” page to trick users into copying and running a Terminal command. It then steals browser, crypto wallet, and Keychain data and sends it to attackers via a Telegram bot, while killing processes to hide…
Microsoft describes a real macOS data-stealing campaign (MacSync Stealer) that relies on social engineering rather than software exploits. Victims are tricked into pasting/running commands in Terminal, which downloads the payload and ultimately steals passwords, keys, and wallet data, then uploads…
Microsoft reports MacSync Stealer infections that start when a user is tricked into pasting or running commands in macOS Terminal (a “ClickFix” style lure). Those commands use built-in tools like curl to download and run the payload, then the stealer collects credentials and sensitive files, stages…
Researchers disclosed a critical Microsoft Copilot (personal) vulnerability chain that could let an attacker steal enterprise data by getting a user to open a legitimate-looking link or summarize a crafted webpage. The attack abuses Copilot features (auto-running prompts, connected-app access, and…
Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled…
