ClickFix Attacks Against macOS Users Evolving

ClickFix attacks are evolving from Windows-focused lures to macOS, with attackers fine-tuning prompts to appear more convincing for Mac users. SecurityWeek notes that CrowdStrike recently reported a campaign aimed at deploying SHAMOS, a macOS information stealer variant, after adapting the fake Cloudflare verification instructions for macOS.

Push Security described its latest delivery as the “most advanced ClickFix” yet, highlighting that the macOS version includes a bespoke, clipboard-copied malicious command and a guided, movie-style video to show users how to complete the steps. The campaign underscores that, while historically harder to reach macOS users than Windows, recent refinements are helping threat actors bypass some security measures, including through manual command copying and Terminal execution.

SecurityWeek has reached out to Apple for comment, and Microsoft is noted as having added defenses to Defender for detecting ClickFix landing pages, with emphasis on user training and awareness as critical defensive measures. According to Microsoft, defending against ClickFix remains challenging due to the social-engineering nature of the technique.