New ClickFix Social Engineering Campaign Targets macOS Users with Fake Troubleshooting Guides Microsoft’s Defender Security Research Team has uncovered a sophisticated cyberattack campaign leveraging a social engineering tactic called ClickFix to compromise Apple computers. Active since late 2025 and continuing into early 2026, the campaign tricks users into executing malicious commands under the guise of legitimate troubleshooting solutions. Attackers distribute fake guides on platforms like Medium, Craft, and Squarespace, offering fixes for common issues such as disk space errors or system malfunctions. Instead of providing downloads, these sites instruct users to copy and paste commands into macOS Terminal, claiming they are system utilities or quick repairs. The guides are often multilingual and appear on websites that have since been taken down or reported. Once executed, the commands bypass macOS security features like Gatekeeper, which typically only scans app bundles and disk images not direct Terminal inputs. The malware including AMOS (Atomic macOS Stealer), Macsync, and SHub Stealer then prompts users to enter their system password under the pretense of installing a "helper tool." If granted, attackers gain full access to sensitive files, settings, and credentials. The malware targets a range of high-value data, including: - iCloud and Telegram account credentials - Private documents, notes, and photos under 2 MB - Cryptocurrency wallet keys (Exodus, Ledger, Trezor) - Saved browser passwords (Chrome, Firefox) - Authentic crypto apps, which attackers replace with trojanized versions to monitor transactions and steal funds The campaign employs fileless attack techniques, using tools like curl and osascript to run malware directly in memory, evading traditional antivirus detection. Microsoft also identified a kill switch in the malware that halts execution if a Russian keyboard layout is detected. In response, Apple has introduced a security feature in macOS 26.4, which now displays a "Possible malware, Paste blocked" warning when users attempt to paste suspicious commands into Terminal. The update aims to mitigate the risk of unintentional execution of malicious scripts.