The ClickFix attack on macOS uses social engineering to convince users to copy and run malicious commands in Terminal under the guise of CAPTCHA or verification checks. The command downloads a malicious DMG file to the /tmp folder, mounts it hidden from the user, and executes an embedded malware installer. The primary malware distributed is Atomic macOS Stealer, which harvests sensitive data from Chromium- and Firefox-based browsers, crypto wallets (desktop apps and browser extensions), Telegram and Discord desktop apps, and Apple ecosystem data such as Safari cookies and Apple Keychain passwords. It also tricks users into entering their macOS password via fake authentication prompts to escalate privileges. The stolen data is compressed and uploaded to attacker servers. Additionally, the malware replaces legitimate Ledger and Trezor wallet apps with malicious versions. The attack exploits user trust and the habit of following instructions, often bypassing macOS security warnings. No direct software vulnerability is exploited; the attack depends on social engineering.

Successful exploitation results in the installation of a powerful infostealer that exfiltrates a wide range of sensitive user data including saved passwords, cookies, autofill data, credit card information, cryptocurrency wallet data, and messaging app data. The attackers gain access to credentials and digital assets, enabling further account compromise, financial theft, and follow-on attacks. The malware also replaces legitimate hardware wallet software with malicious versions, increasing risk to cryptocurrency holdings. The attack compromises user privacy and security on macOS devices.

No official patch or fix is available as this attack relies on social engineering rather than software vulnerabilities. Users should never paste commands into Terminal prompted by websites or untrusted sources. They should avoid entering their macOS administrator password unless they fully understand the requesting app. Regularly installing macOS security updates is recommended. Users should trust macOS security warnings and use reputable security software to detect and block malicious activity. Employing secure password managers and exercising caution with unknown websites can reduce risk.