TLDR
The Macfinger ClickFix campaign is an active social engineering attack that tricks macOS users into running malware themselves. Victims land on a fake CAPTCHA or verification page, which silently injects a malicious shell command into the...
How it works
The Macfinger ClickFix campaign is an active social engineering attack that tricks macOS users into running malware themselves. Victims land on a fake CAPTCHA or verification page, which silently injects a malicious shell command into the...
Red flags
- : A CAPTCHA page asks you to open Terminal and paste/run a command ("verification" should never require shell input). Clipboard is silently filled with an unfamiliar curl or shell snippet without your action. A binary named com.apple.periodic runs from a user caches directory mimicking system software
What to do
- 1: Never paste commands copied from a website into Terminal
- 2legitimate services do not ask you to do this. Block the listed domains/IPs and monitor egress traffic to non standard ports (e.g., :8133 ) and Go http client/1.1 Web
Source
FAQ
Is Macfinger ClickFix Campaign Targets macOS Users via Fake CAPTCHA and Terminal Trick a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: A CAPTCHA page asks you to open Terminal and paste/run a command ("verification" should never require shell input). Clipboard is silently filled with an unfamiliar curl or shell snippet without your action. A binary named com.apple.periodic runs from a user caches directory mimicking system software
What should I do first?
: Never paste commands copied from a website into Terminal; legitimate services do not ask you to do this. Block the listed domains/IPs and monitor egress traffic to non standard ports (e.g., :8133 ) and Go http client/1.1 Web
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.