Hackers Abuse Verified X Ads to Deliver Mac Malware Through ClickFix Attack

A sponsored, verified ad campaign on X directed macOS users to a lookalike site (dynamicmacisland.com) that instructed victims to paste Terminal commands, silently installing macOS malware (Atomic Stealer variants) to exfiltrate credentials and browser data. The report also describes ConsentFix, a browser/OAuth manipulation enabling rapid account takeover by extracting valid tokens via drag-and-drop interactions, and provides mitigation advice such as tightening ad/brand monitoring, endpoint protections, conditional access, and user education.