Actor Profile

ClickFix is a threat actor conducting social engineering campaigns that trick users into executing malicious commands. The actor leverages deceptive techniques to convince victims to manually run Terminal commands on macOS systems, facilitating the delivery of information-stealing malware. ClickFix campaigns are characterized by their reliance on user interaction to bypass traditional security controls, exploiting trust and technical unfamiliarity rather than software vulnerabilities.

TTPs (Tactics, Techniques, Procedures)

The campaign employs T1204.002 (User Execution: Malicious File) by tricking users into executing Terminal commands that download and mount malicious DMG files. T1566 (Phishing) is likely used for initial access to deliver the social engineering lure. T1059.004 (Command and Scripting Interpreter: Unix Shell) enables execution of Terminal commands to automate the download and mounting process. T1560 (Archive Collected Data) and T1005 (Data from Local System) support the infostealer payload's collection objectives. The use of DMG files suggests T1204.001 (Malicious Link) may also be present in the delivery chain.

Targets & Patterns

The campaign targets macOS users broadly, with no specific sector or geographic focus identified. The attack methodology suggests opportunistic targeting, relying on social engineering to reach a wide victim base. Users who are less familiar with Terminal commands or security best practices are particularly vulnerable. The shift to macOS indicates ClickFix is expanding beyond traditional Windows-focused campaigns, potentially seeking to exploit the growing macOS enterprise footprint and perceived security advantages that may lead to reduced vigilance among users.

Historical Context

ClickFix has previously been associated with Windows-based campaigns using similar social engineering tactics to trick users into executing malicious commands, often through fake CAPTCHA pages or technical support lures. This macOS campaign represents a platform expansion, adapting the core ClickFix methodology to Unix-based systems. The use of Terminal commands mirrors the PowerShell-based techniques observed in earlier Windows campaigns, demonstrating the actor's ability to translate tactics across operating systems while maintaining the fundamental user-execution approach.

Defensive Recommendations

  • Monitor and alert on suspicious Terminal command execution, particularly hdiutil, curl, or wget commands downloading from external sources (T1059.004)
  • Implement application control policies to restrict execution of unsigned or untrusted applications from mounted DMG files
  • Deploy user awareness training focused on ClickFix-style social engineering tactics that request manual command execution
  • Enable and monitor macOS Unified Logs for disk image mounting events and correlate with network downloads from unfamiliar domains
  • Restrict Terminal access for standard users where possible, or implement command logging and behavioral analytics to detect anomalous shell activity