Apple Blocks New 'ClickFix' Malware Targeting Macs

A sophisticated scam known as 'ClickFix,' which previously targeted Windows users, has recently been observed attempting to ensnare macOS owners. This malicious scheme deceives users into executing technical instructions under the guise of fixing their computers, but instead installs malware.

The ClickFix attack method commonly appears as a fake 'Verify You're Human' test or a fraudulent Windows update, prompting users to copy and paste commands into their system's dialog boxes. On macOS, threat actors have been publishing fake troubleshooting guides, particularly on platforms like Medium, to trick users into opening the Terminal utility and running malicious commands.

These commands, once executed, can lead to malware infection capable of spying on the machine, stealing sensitive data, and even replacing cryptocurrency wallet applications with attacker-controlled versions. The scheme preys on the common misconception that macOS is immune to viruses, and the user's active participation in running the commands increases the infection's success rate.

However, Apple has implemented a new protective measure in MacOS 26.4, released in March. This update provides warnings when users attempt to paste commands into Terminal, flagging them as potential malware threats. These safeguards are specifically designed to protect less-technical users. Apple's Xprotect antivirus has also been upgraded to combat the malware associated with these attacks, and the malicious websites identified by Microsoft have reportedly been taken down.