[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f66bMBLGxfaMrwSWbCbRo-F1Sip7oz748Xjqv0qpmFMg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":46,"controls":47},"c1b7b6f0-ee73-43cb-b943-ecf84170ab50","macos-clickfix-campaign-tricks-users-into-running-malicious-terminal-commands","39c70eeb-5dd4-4fbb-86e1-7e7c4d1f66cc","macOS ClickFix Campaign Tricks Users Into Running Malicious Terminal Commands","This attack exploits human trust by presenting fake CAPTCHA pages that instruct users to paste and execute malicious Terminal commands, bypassing traditional malware delivery defenses entirely. The social engineering technique known as ClickFix is particularly dangerous because it weaponizes the user themselves, making security tools that scan for malicious downloads less effective. Once executed, the command silently mounts a DMG file and deploys the Atomic macOS Stealer, exfiltrating credentials, Keychain data, and cryptocurrency wallet information. This matters because macOS users often operate under a false sense of security, and attacks that leverage native OS tools like Terminal are harder to detect with conventional antivirus solutions.","**Immediate actions:**\n- Educate users to never copy-paste Terminal commands from websites, browser pop-ups, or CAPTCHA-style prompts regardless of how legitimate they appear.\n- Deploy endpoint detection and response (EDR) tools capable of monitoring and alerting on suspicious Terminal\u002Fshell command executions on macOS devices.\n- Review and restrict which users have the ability to install or mount DMG files on managed macOS endpoints.\n\n**Long-term improvements:**\n- Enforce macOS Application Control policies via MDM (e.g., Jamf or Intune) to block execution of unsigned or untrusted binaries and mounted disk images.\n- Implement DNS filtering and web proxies to block access to known malicious or newly registered domains used in phishing and ClickFix campaigns.\n- Establish a formal security awareness training program that includes simulated social engineering scenarios targeting macOS users specifically.\n\n**Detection measures:**\n- Configure centralized logging to capture Terminal command history and shell process spawning events across all macOS endpoints.\n- Set up alerts for anomalous DMG mount events or processes spawned from user-interactive shell sessions outside of normal business activity.\n- Monitor for known AMOS indicators of compromise (IOCs) such as suspicious outbound connections to C2 infrastructure or access patterns targeting Keychain and browser credential stores.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 3: Data Protection","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 CM-7: Least Functionality","NIST CSF DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing (credential\u002FPII data at risk)","MITRE ATT&CK T1204.002: User Execution – Malicious File","MITRE ATT&CK T1059.004: Command and Scripting Interpreter – Unix Shell","MITRE ATT&CK T1555.001: Credentials from Password Stores – Keychain",{},"published","2026-06-23T20:21:31.687539+00:00","2026-06-23T20:21:31.569+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer\u002F","new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer-dca893","New macOS ClickFix attack silently mounts DMGs to push infostealer",[34,40],{"id":35,"name":36,"slug":37,"description":38,"color":39},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":41,"name":42,"slug":43,"description":44,"color":45},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[48,52,56],{"slug":49,"name":50,"problem":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":53,"name":54,"problem":55},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":57,"name":58,"problem":59},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]