Fake CleanMyMac Site Uses ClickFix Trick to Install SHub Stealer on macOS

A fraudulent website impersonating CleanMyMac uses a ClickFix social-engineering trick to get macOS users to run a Terminal command that installs SHub Stealer. The malware bypasses Gatekeeper, performs locale-based geofencing to avoid Russian layouts, harvests system passwords and Keychain data via an AppleScript prompt, modifies popular cryptocurrency wallet applications to display fake recovery prompts and exfiltrate seed phrases, and establishes persistence with a LaunchAgent masquerading as Google’s Keystone updater.