ClickFix finds a new way to infect Macs

ClickFix finds a new way to infect Macs

Don’t have an account? Sign up > Try our antivirus with a free, full-featured 14-day trial Protect your team’s devices and data – no IT skills needed Explore award-winning endpoint security for your business ClickFix campaigns are looking for alternatives now that many Mac users have been made aware of the dangers of pasting certain commands into Terminal. Researchers found that ClickFix has kept the same social engineering playbook but completely sidestepped Terminal by using the applescript:// URL scheme to auto‑open Script Editor with a ready‑to‑run script that pulls Atomic Stealer. ClickFix is a social engineering method that tricks users into infecting their own device with malware. Users are instructed to run specific commands that download malware, usually an infostealer. The attackers replaced “copy, paste into Terminal” with “just click this button and run a script Apple prepare

Source: https://www.malwarebytes.com/blog/news/2026/04/clickfix-finds-new-way-to-infect-macs