This threat involves a macOS-targeted malware campaign named ClickFix that uses social engineering via fake CAPTCHA pages to convince users to execute malicious commands. The commands download and mount a DMG containing a self-signed infostealer application identified as part of the AMOS (Atomic macOS Stealer) lineage, Odyssey variant. The malware harvests extensive sensitive information including browser credentials, cryptocurrency wallet data from 13 standalone apps and 201 browser extensions, messaging app data, Apple Notes, Safari cookies, and macOS keychain entries. It exfiltrates compressed data to two command-and-control servers. The malware establishes persistence through LaunchAgent and compromises legitimate cryptocurrency applications by replacing them with trojanized versions fetched from attacker infrastructure. No CVE or patch information is available, and no known exploits in the wild have been reported.

The malware compromises user credentials, cryptocurrency wallets, messaging data, and other sensitive information on macOS systems. It can deceive users into providing passwords and maintains persistence by trojanizing legitimate cryptocurrency applications, potentially leading to significant data theft and financial loss. The campaign targets a broad range of sensitive data sources, increasing the risk of identity theft, financial fraud, and privacy violations.

No official patch or remediation is available as this is a malware campaign relying on social engineering and user interaction. Mitigation focuses on user education to avoid executing untrusted Terminal commands and downloading software from unverified sources. Monitoring for suspicious LaunchAgent entries and verifying the integrity of cryptocurrency applications like Ledger Live and Trezor Suite is recommended. Users should only download software from official vendor sources and be cautious of unexpected password prompts. Since the malware uses self-signed applications and trojanizes legitimate apps, endpoint protection solutions with behavioral detection may help identify and block this threat.