New macOS ClickFix Attack Silently Mounts DMGs to Deploy Infostealer Malware.

New macOS ClickFix Attack Silently Mounts DMGs to Deploy Infostealer Malware.

Information

What is ClickFix?

  ClickFix is a social engineering attack technique in which threat actors trick users into executing malicious commands or installing malware themselves, rather than exploiting software or operating system vulnerabilities. Attackers typically create fake CAPTCHA pages, Cloudflare verification prompts, or system warning messages that appear legitimate in order to persuade victims to follow malicious instructions.

Incident

  Cybersecurity researchers from Palo Alto Networks' Unit 42 have discovered a new ClickFix campaign targeting macOS users. Unlike traditional malware attacks that exploit software vulnerabilities, this campaign relies on social engineering, tricking users into manually executing malicious commands in the macOS Terminal application.

   The attackers disguise their malicious activities as a legitimate human verification process, convincing victims to copy and execute commands that ultimately install malware on their devices. The campaign delivers Atomic macOS Stealer (AMOS), a well-known information-stealing malware capable of collecting sensitive user data, including browser credentials, cryptocurrency wallets, and authentication tokens.

  This attack demonstrates the continued evolution of ClickFix techniques beyond Windows environments and highlights the growing focus of cybercriminals on macOS users.

Picture 1 Malicious Terminal command used as fake Captcha verification

Attack Flow

  The attack begins when victims visit a compromised or malicious website that displays a fake CAPTCHA or "Verify You Are Human" page. The page mimics trusted services such as Cloudflare or other website verification systems to appear legitimate.

  Instead of asking users to solve a normal CAPTCHA challenge, the website instructs them to open the Terminal application and paste a command into it. The attackers claim that this action is required to complete the verification process or resolve browser issues.

  Once executed, the command silently downloads a malicious Disk Image (DMG) file from a remote server controlled by the attackers. The script then automatically mounts the DMG and launches its contents, allowing the malware installation process to proceed with minimal user interaction.

  Unlike traditional malware delivery methods that require users to manually open downloaded files, this technique automates much of the process, making the attack more convincing and reducing the likelihood that victims will recognize malicious behavior.

Picture 2 Infostealer attack flow.

Impact

  Once installed, AMOS attempts to collect various types of sensitive information from the infected device, including:

• Browser usernames and passwords
• Browser cookies and session tokens
• Apple Keychain credentials
• Cryptocurrency wallet information
• Instant messaging application data
• Files and documents stored on the device

  The collected information is then transmitted to the attackers' command-and-control (C2) infrastructure, where it can be used for credential theft, account takeover, financial fraud, identity theft, or sold on underground marketplaces.

  Although this campaign does not exploit a software vulnerability in macOS, it represents a significant security threat because it relies on human interaction rather than technical exploitation.

  Many users assume that commands provided by websites are safe, particularly when presented during what appears to be a legitimate verification process. This trust allows attackers to bypass many traditional security protections.

  Furthermore, the use of DMG files—commonly used for legitimate macOS software distribution—helps the malware blend in with normal user activity, making detection more difficult.

  The campaign also illustrates that macOS users are increasingly becoming attractive targets for cybercriminals, challenging the common misconception that Apple's operating system is immune to malware attacks.

Recommendation

1.Never copy and execute Terminal commands from untrusted websites or unknown sources.

2.Be cautious of CAPTCHA or verification pages requesting unusual actions, particularly those involving Terminal or command-line utilities.

3.Deploy Endpoint Detection and Response (EDR) solutions capable of monitoring suspicious Terminal activity and unauthorized DMG execution.

4.Keep macOS and all security software updated with the latest patches.

5.Conduct cybersecurity awareness training to educate users about ClickFix techniques and other forms of social engineering attacks.

The important things is Security systems. We must concern and monitor as usual.
For more information please contact
Email :sales@inetms.co.th
065 149 2822 (Ms.Suphatson )
063 204 4534 (Ms.Atsamaphorn)
065 929 6330 (Ms.Kansinee)
092 257 6902 (Ms.Narusorn)
063 197 7510 (Mr.Yanotai)
065 725 7405 (Ms.Nattharini)
065 725 7405 (Ms.Donraya)

References

• https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/
• https://www.infosecurityeurope.com/en-gb/blog/threat-vectors/what-is-clickfix-how-prevent.html

Weekly Interesting CVE

Malware News or Campaign IOC/IOA | EN

Ref: https://thehackernews.com/2026/06/junior-hacker-used-tailscale-and.html