Hackers Use ClickFix and Malicious DMG Files to Deliver notnullOSX on macOS

A targeted macOS info-stealer called notnullOSX, written in Go and sold via an affiliate model, is being used to compromise high-value cryptocurrency holders by tricking victims into granting Full Disk Access or running terminal commands; it uses modular theft binaries (iMessageGrab, CryptoWalletsGrab, ReplaceApp, etc.), maintains a persistent WebSocket connection to a Firebase C2, and has confirmed detections across multiple countries — defenders are advised to block known C2 domains, alert on unexpected Full Disk Access grants, and monitor /tmp and LaunchAgents for staged Mach-O binaries.