The ClickFix macOS campaign employs social engineering by presenting fake CAPTCHA pages that instruct victims to execute a Terminal command. This command silently downloads a malicious DMG file from attacker-controlled servers, mounts it using macOS's hdiutil utility with the -nobrowse flag to avoid user detection, and automatically launches the contained malicious application. The payload is the Atomic macOS Stealer (AMOS), which harvests sensitive data including credentials from eight Chromium-based browsers and multiple Firefox derivatives, cryptocurrency wallet data from numerous wallet applications, messaging app data (Telegram Desktop and Discord), Apple Notes, Safari cookies, Apple Keychain, and user documents with PDF, TXT, or RTF extensions. The malware also replaces legitimate cryptocurrency management software (Ledger Live and Trezor Suite) with malicious versions to facilitate theft. All collected data is compressed and exfiltrated to attacker servers. The campaign was discovered by Palo Alto Networks Unit 42 and uses command-and-control domains such as svs-verificationdate[.]beer. This attack leverages a combination of social engineering and native macOS utilities to evade detection and automate malware execution.

The campaign results in the compromise of sensitive user data including browser credentials, stored payment cards, authentication tokens, cryptocurrency wallets, messaging app data, Apple Keychain passwords, and user documents. The replacement of legitimate Ledger Live and Trezor Suite applications with malicious versions poses a direct risk of cryptocurrency theft. The silent mounting and execution of malware without user awareness increases the likelihood of successful infection. This can lead to significant privacy breaches, financial loss, and unauthorized access to personal and corporate accounts.

No official patch or fix is available as this is a social engineering attack leveraging native macOS utilities. Users should be educated to never execute Terminal commands from untrusted or suspicious sources, especially those presented as CAPTCHA verifications or system fixes. Security teams should raise awareness about the ClickFix technique and monitor for suspicious use of hdiutil and unexpected DMG mounts. Since the attack relies on user interaction, user training and caution are the primary mitigations. There is no indication that vendor patches or updates can prevent this attack directly.