ClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites

A widespread ClickFix campaign compromises hundreds of WordPress sites to serve a full-screen iframe overlay that coerces macOS visitors into pasting a clipboard command; the command fetches an in-memory gzip/Base64 dropper that runs an osascript-driven infostealer to harvest Keychain items, browser profiles, SSH keys and exfiltrate data to genomicsforge.com, while the C2 URL is stored in a Polygon smart contract to resist takedowns — the report includes IOCs and mitigation steps.