A new macOS ClickFix campaign is actively using Terminal commands to download, mount, and launch info-stealing malware from malicious disk image (DMG) files, BleepingComputer reports. The attack relies on social engineering to trick users into executing commands that silently install the payload.
The campaign poses a significant threat due to its stealthy delivery mechanism, which bypasses typical user warnings. While no CVSS score or specific CVE was disclosed in the reporting, the attack is being actively exploited, according to researchers cited by BleepingComputer.
Technically, the attack begins when a user visits a compromised or malicious website that displays a fake error message or prompt. The victim is instructed to open Terminal and paste commands that mount a DMG containing the infostealer. Once mounted, the malware runs automatically, exfiltrating credentials and other sensitive data.
No official patches are required from Apple as this is not a system vulnerability but a social engineering scheme. Users are advised to avoid pasting unknown commands into Terminal, verify website legitimacy, and use endpoint detection tools to block unsolicited DMG mounts.
The campaign's attribution remains unknown at this time. This attack underscores a growing trend of cross-platform ClickFix tactics, previously seen on Windows, now targeting macOS users with similar deceptive social engineering.