Malware - ClickFix Campaigns Distribute MacSync Infostealer

What Happened

Three distinct ClickFix campaigns have emerged as significant threats, delivering a macOS information stealer known as MacSync. These campaigns cleverly exploit user interaction rather than traditional exploit-based methods. By prompting users to copy and execute commands, they effectively target those unaware of the risks associated with running unknown terminal commands. This strategy has proven particularly effective against macOS users, who often trust such interactions.

The campaigns have evolved over several months, with the first identified in November 2025. This initial campaign used a fake OpenAI Atlas browser to lure users into downloading malicious scripts. Subsequent campaigns have continued to refine their tactics, leveraging social engineering to convince users to execute harmful commands.

Who's Being Targeted

The ClickFix campaigns primarily target macOS users, particularly those involved in development or using AI tools. Researchers have noted that these users often possess higher-value credentials, including SSH keys and cryptocurrency wallets. The campaigns have reached users in various regions, including Belgium, India, and parts of North and South America.

The deceptive nature of these campaigns allows them to bypass traditional security measures. As users are led to believe they are downloading legitimate software, they unknowingly execute commands that install the MacSync infostealer. This malware is designed to harvest sensitive information, making it a lucrative target for cybercriminals.

Signs of Infection

Users may notice several indicators of infection after executing commands from these campaigns. The MacSync infostealer is capable of exfiltrating a wide range of sensitive data, including credentials, files, and even cryptocurrency seed phrases. Additionally, the malware is designed to remove traces of its activities, complicating incident response efforts.

The latest variant of MacSync has been observed to support dynamic AppleScript payloads and in-memory execution, making it harder to detect. Users should be vigilant for unusual system behavior, such as unexpected prompts for system passwords or unfamiliar applications running in the background.

How to Protect Yourself

To defend against these types of attacks, users should exercise caution when downloading software or executing commands from unverified sources. Here are some recommended actions:

• Verify Sources: Always download software from official websites or trusted sources.
• Educate Yourself: Understand the risks associated with executing terminal commands, especially those that request elevated permissions.
• Use Security Software: Employ reputable security solutions that can help identify and block malicious activities.
• Stay Informed: Keep up to date with the latest cybersecurity threats and tactics used by cybercriminals.

By adopting a cautious approach and maintaining a strong security posture, users can significantly reduce their risk of falling victim to these sophisticated malware campaigns.