macOS ClickFix attacks deliver AppleScript stealers to snarf credentials, wallets

Netskope observed an active ClickFix campaign targeting macOS users that uses a fake CAPTCHA and a Spotlight "paste" trick to execute a downloaded AppleScript infostealer. The malware forces victims to enter their system password via a persistent fake dialog, harvests macOS Keychain data, session tokens and cookies from 12 Chromium-based browsers plus Firefox/Waterfox, extracts data from 200+ browser extensions, and steals credentials from 16 desktop cryptocurrency wallets before staging data in /tmp/xdivcmp and exfiltrating it to a hardcoded C2; Netskope published related IoCs and scripts.