MalwarePublished 23 Jun 2026

New macOS ClickFix attack silently mounts DMGs to push infostealer

Source Bleeping Computer

macos

Description

A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. [...]

Impact

The campaign results in the compromise of sensitive user data including browser credentials, stored payment cards, authentication tokens, cryptocurrency wallets, messaging app data, Apple Keychain passwords, and user documents. The replacement of legitimate Ledger Live and Trezor Suite applications with malicious versions poses a direct risk of cryptocurrency theft. The silent mounting and execution of malware without user awareness increases the likelihood of successful infection. This can lead to significant privacy breaches, financial loss, and unauthorized access to personal and corporate accounts.

Defensive guidance

Users should be educated to never execute Terminal commands from untrusted or suspicious sources, especially those presented as CAPTCHA verifications or system fixes. Security teams should raise awareness about the ClickFix technique and monitor for suspicious use of hdiutil and unexpected DMG mounts. Since the attack relies on user interaction, user training and caution are the primary mitigations. There is no indication that vendor patches or updates can prevent this attack directly.

References

bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 23 Jun 2026, 18:40 UTC

References

Community reviews

Related threats