Security experts have recently uncovered a new infostealing macOS malware distributed through ClickFix social engineering tactics. Huntress, a managed detection and response (MDR) specialist, reported encountering this malware in June of 2026.
ClickFix attacks involve a popup window that masquerades as a CAPTCHA prompt, instructing users to copy and paste a long command string into their Terminal application. This command string typically initiates the download and execution of the malware.
In the specific attack identified by Huntress, the initial command fetched a Bash profiler/loader that gathered system information before retrieving a Mac-native Mach-O payload tailored to the victim’s processor architecture. The Mach-O format is used for macOS executables, and in this case, the malware was designed to extract browser passwords, Apple Keychain data, and cached credentials from the infected system. Additionally, the malware included a function that could check cryptocurrency wallets for funds and redirect them to the attacker’s control.
The loader, payload hosting, and command and control (C2) infrastructure were all traced back to the Aeza Group, a Russian bulletproof hosting provider linked to cybercrime activities. Huntress recommended organizations protect against ClickFix threats by educating users and implementing browser add-ons like NoScript to mitigate malicious scripts. Network devices such as Pi-Hole DNS can also block known malicious domains to prevent popup windows from appearing.
If a user falls victim to a ClickFix attack, Huntress advised immediately informing IT teams and isolating the affected machine. Although the malware may attempt to establish persistence, it can be remedied by deleting any copies of the malicious binary. Once removed, the malware will not regenerate on its own.
By staying vigilant and implementing proactive security measures, organizations can reduce the risk of falling prey to ClickFix attacks and other malicious threats targeting macOS users.