New ClickFix Attack Targets macOS Users With Fake Disk Cleanup and Utility Lures

This report details the 'ClickFix' macOS campaign where attackers publish fake disk-cleanup/system utility guides that instruct users to paste Terminal commands which then download and execute infostealer payloads (Macsync, Shub Stealer, AMOS). The malware harvests passwords, Keychain data, browser credentials, iCloud and cryptocurrency wallet material, establishes persistence via LaunchAgents/LaunchDaemons (including masquerading as Google Update), and uses a variety of C2/endpoints; the report includes numerous domains, IPs, URLs, SHA-256 hashes, file paths, and detection recommendations.