New “ClickFix” Campaign Bypasses Gatekeeper to Hijack macOS Devices

Microsoft researchers warn of an active macOS infostealer campaign using social‑engineering 'ClickFix' posts that trick users into pasting Terminal commands; three tracked variants (Loader Install, Script Install, Helper/AMOS) employ in‑memory execution, C2 via Telegram fallback, virtualization checks, trojanized crypto wallets, and a root‑persistent Launch Daemon to steal credentials, iCloud data, and crypto funds—highlighting that copying arbitrary Terminal commands from untrusted sources can bypass Gatekeeper and enable malware execution.