ClickFix macOS Stealer Targets Crypto, Keychain, Browser Creds

Sun, 09 Aug 2026 11:41:42 +0000

Engineer — Learn: No KEV, PoC, or active enterprise exploitation signals; this is a socially-engineered user-side attack. Worth noting if your org has mac-heavy developer populations with crypto assets or shared Keychain credentials that could pivot to cloud access.
SOC/IR — Plan: ClickFix lures dropping shell scripts followed by architecture-aware macOS payloads represent a detectable chain — build or tune detections for unexpected shell script execution on macOS endpoints followed by outbound connections, and verify EDR coverage for macOS stealer behavior (Keychain access, browser credential reads).
Leader — Skip

Stealer-Malware on CuraSec