AnalysisPublished 27 Jul 2026

ClickFix on macOS: how the Terminal-based attack works, and how to protect yourself | Kaspersky official blog

Source Kaspersky Security Blog

macos

Description

We break down how ClickFix works on macOS: why attackers trick users into running commands in Terminal, what data the malware steals, and how to protect your device.

Impact

Successful exploitation results in the installation of a powerful infostealer that exfiltrates a wide range of sensitive user data including saved passwords, cookies, autofill data, credit card information, cryptocurrency wallet data, and messaging app data. The attackers gain access to credentials and digital assets, enabling further account compromise, financial theft, and follow-on attacks. The malware also replaces legitimate hardware wallet software with malicious versions, increasing risk to cryptocurrency holdings. The attack compromises user privacy and security on macOS devices.

Defensive guidance

Users should never paste commands into Terminal prompted by websites or untrusted sources. They should avoid entering their macOS administrator password unless they fully understand the requesting app. Regularly installing macOS security updates is recommended. Users should trust macOS security warnings and use reputable security software to detect and block malicious activity. Employing secure password managers and exercising caution with unknown websites can reduce risk.

Summary

The ClickFix attack on macOS uses social engineering to convince users to copy and run malicious commands in Terminal under the guise of CAPTCHA or verification checks. The command downloads a malicious DMG file to the /tmp folder, mounts it hidden from the user, and executes an embedded malware installer. The primary malware distributed is Atomic macOS Stealer, which harvests sensitive data from Chromium- and Firefox-based browsers, crypto wallets (desktop apps and browser extensions), Telegram and Discord desktop apps, and Apple ecosystem data such as Safari cookies and Apple Keychain passwords. It also tricks users into entering their macOS password via fake authentication prompts to escalate privileges. The stolen data is compressed and uploaded to attacker servers. Additionally, the malware replaces legitimate Ledger and Trezor wallet apps with malicious versions. The attack exploits user trust and the habit of following instructions, often bypassing macOS security warnings. No direct software vulnerability is exploited; the attack depends on social engineering.

References

kaspersky.com/blog/macos-clickfix-attack/56187/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Jul 2026, 15:48 UTC

References

Community reviews

Related threats