Listen to the episode
TLDR
A new ClickFix campaign targets macOS users with a Go based infostealer that steals cryptocurrency wallets, browser passwords, and Apple Keychain data. Victims receive an email linking to a page that instructs them to paste and run a...
How it works
A new ClickFix campaign targets macOS users with a Go based infostealer that steals cryptocurrency wallets, browser passwords, and Apple Keychain data. Victims receive an email linking to a page that instructs them to paste and run a...
Red flags
- Unsolicited emails or pages asking you to run Terminal commands to fix, verify, or unlock something A sudden, unexpected system password prompt appearing right after running a Terminal command Crypto transactions completing successfully but arriving with a smaller amount than expected
What to do
- 1Never paste commands into Terminal from a website, email, or chat message
- 2type them yourself only if you fully understand them Keep macOS and Gatekeeper enabled, and reject any password prompt you did not explicitly trigger yourself Store significant crypto holdings on a hardware wallet and review transaction confirmations carefully
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/FAQ
Is ClickFix macOS attack steals crypto and credentials via fake Terminal instructions a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Unsolicited emails or pages asking you to run Terminal commands to fix, verify, or unlock something A sudden, unexpected system password prompt appearing right after running a Terminal command Crypto transactions completing successfully but arriving with a smaller amount than expected
What should I do first?
Never paste commands into Terminal from a website, email, or chat message; type them yourself only if you fully understand them Keep macOS and Gatekeeper enabled, and reject any password prompt you did not explicitly trigger yourself Store significant crypto holdings on a hardware wallet and review transaction confirmations carefully
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.