This macOS malware campaign, named ClickFix, uses social engineering through fake CAPTCHA pages to convince users to execute malicious commands that download and mount a DMG containing a self-signed information stealer identified as the AMOS Odyssey variant. The malware collects extensive sensitive information including browser credentials, cryptocurrency wallet data from 13 standalone apps and 201 browser extensions, messaging app data, Apple Notes, Safari cookies, and macOS keychain entries. It compresses and exfiltrates this data to two command-and-control servers. The malware maintains persistence by creating LaunchAgent entries and compromises legitimate cryptocurrency applications by replacing them with trojanized versions fetched from attacker infrastructure. There is no CVE or patch available, and no known active exploitation has been reported.

The malware compromises a broad range of sensitive user data on macOS systems, including credentials, cryptocurrency wallets, messaging data, and keychain entries. By prompting users for passwords via fake system dialogs and trojanizing legitimate cryptocurrency applications, it can lead to significant data theft and potential financial loss. The campaign's ability to harvest data from numerous applications and extensions increases the risk of identity theft, financial fraud, and privacy violations.

No official patch or remediation is available as this is a malware campaign relying on social engineering and user interaction. Mitigation should focus on user education to avoid executing untrusted Terminal commands and downloading software from unverified sources. Monitoring for suspicious LaunchAgent entries and verifying the integrity of cryptocurrency applications such as Ledger Live and Trezor Suite is recommended. Users should only download software from official vendor sources and be cautious of unexpected password prompts. Endpoint protection solutions with behavioral detection capabilities may help identify and block this threat.