Recent ClickFix campaigns are using social engineering to trick macOS users into executing terminal commands that install an information stealer known as MacSync. By leveraging trusted platforms like ChatGPT and GitHub as bait, attackers bypass traditional security exploits by convincing victims to manually run malicious scripts that exfiltrate sensitive data.
Sophos researchers have identified a series of evolving campaigns that rely entirely on user interaction rather than technical exploits. This method proves effective because it exploits the trust users place in familiar web services, leading them to copy and paste obfuscated commands into their terminal. Once executed, these commands download shell scripts that prompt for system passwords, allowing the MacSync malware to run with elevated permissions and begin harvesting credentials and cryptocurrency wallet information.
The first identified wave in late 2025 utilized fraudulent Google search ads for ChatGPT to lure victims to fake download pages. These pages instructed users to run commands that appeared to be part of a legitimate setup process but instead deployed the infostealer. A subsequent campaign in December refined this tactic by using actual shared conversations on the legitimate OpenAI website to direct users toward malicious GitHub-themed landing pages, adding a layer of authenticity to the scam.
By early 2026, the threat evolved into a more sophisticated variant targeting a global audience across Belgium, India, and the Americas. This version of MacSync introduced dynamic AppleScript payloads and in-memory execution, techniques specifically designed to evade detection by antivirus software and complicate the work of security analysts. This shift indicates that the developers are actively modifying their code to stay ahead of updated macOS security measures.
The shell scripts used in these attacks are programmed to contact remote servers and download the final payload while simultaneously deleting traces of the intrusion. Beyond simply stealing files, the malware is capable of extracting keychain databases and seed phrases from crypto wallets. The attackers have also been observed using various legitimate hosting platforms like Cloudflare and Squarespace to disguise their malicious instructions as genuine developer tool installations.
Security experts warn that these ClickFix tactics will likely continue to evolve as attackers find new ways to weaponize human trust. Because the attack surface is the user rather than a software vulnerability, defense relies heavily on awareness of the dangers of running unverified terminal commands. As malware developers refine their social engineering and obfuscation techniques, the risk to macOS users remains high across both personal and professional environments.
Source: ClickFix Campaigns Spread MacSync Stealer via Fake AI Tool Installs