New ClickFix Attack Targeting Windows and macOS Users to Deploy Infostealer Malware

Security researchers have traced a sophisticated ClickFix campaign that targets Windows and macOS users to deploy infostealer malware via fake security prompts and compromised Google-hosted landing pages. The infection chain begins when users search for cracked software, with pages on Colab, Drive, Looker Studio, Sites, and Groups guiding victims to a deceptive Cloudflare verification page that prompts them to run a Base64-encoded shell command in memory.

Windows devices receive ACR stealer while macOS machines receive Odyssey stealer, with initial payloads delivered as password-protected ZIP archives that deploy the full infostealer in a fileless, in-memory fashion. Researchers noted a dramatic rise in activity, documenting nearly 700 percent more ACR stealer logs uploaded to underground markets in May 2025, amounting to 133,980 new compromised user logs that month.

According to Microsoft’s 2025 Digital Defense Report, ClickFix is the most common initial access method, accounting for 47 percent of all initial access schemes, underscoring the threat to both platforms.