ClickFix Campaign Uses AppleScript Stealer to Target macOS Credentials and Session Cookies
Summary
Netskope details a ClickFix campaign that tricks macOS users into running a command, then uses a persistent fake password prompt to steal credentials, keychain and browser data, extension contents, and cryptocurrency wallet files.
Key points
- A landing page filters out mobile users and routes desktop victims to Windows or macOS payloads based on their user-agent.
- A fake CAPTCHA instructs victims to paste and run a command that downloads and silently executes the macOS script.
- The AppleScript displays a persistent, convincing password dialog and validates entered credentials in real time.
- The stealer targets the macOS Keychain, browser cookies and saved data, data from more than 200 extensions, and files from 16 cryptocurrency wallets.
- Stolen data is compressed into a ZIP archive and sent to the attacker’s server over HTTP; the script then removes its staging files.
- Stolen session cookies can enable account access by hijacking active sessions and bypassing MFA.
- Netskope recommends updating to macOS Tahoe 26.4 or macOS Sequoia, which adds a Terminal warning about pasting potentially malicious commands.
Article Details
- Attack Vectors
- A fake CAPTCHA page uses client-side JavaScript to filter for desktop users and direct macOS users to an AppleScript-based loader.
- Victims are tricked into copying and pasting a malicious command into Terminal, which downloads and runs the script in the background.
- A persistent deceptive AppleScript dialog prompts victims for their system password and repeatedly reappears until a valid password is entered.
- The script collects Keychain data, browser credentials and session cookies, extension data, and files from standalone cryptocurrency wallets, then exfiltrates the collected data.
- Defensive Notes
- The article recommends updating to macOS Tahoe 26.4 or macOS Sequoia, whose Terminal security warning alerts users before they paste potentially harmful commands from an untrusted source.
- Treat commands presented by fake CAPTCHA pages or other untrusted sources as suspicious; the described attack depends on victims manually pasting and executing the command.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxp[:]//172[.]94[.]9[.]250 | Attacker's command-and-control server; the article says stolen data is exfiltrated to it via HTTP POST. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe archived stolen data is exfiltrated to the attacker's command-and-control server via HTTP POST.T1056.002 · GUI Input CaptureA deceptive, persistent dialog captures the victim's system password.T1059.002 · AppleScriptThe macOS payload is an AppleScript-based loader and stealer.T1059.004 · Unix ShellThe pasted command runs in the victim's terminal and downloads and executes the malicious script.T1204.004 · Malicious Copy and PasteVictims are tricked into manually copying and pasting a malicious command into Terminal.T1539 · Steal Web Session CookieThe stealer collects live session cookies from browsers and extensions.T1555.001 · KeychainThe script targets the macOS Keychain database after capturing the user's login password.T1555.003 · Credentials from Web BrowsersThe stealer collects saved credentials from browser Login Data databases and Firefox logins.json files.T1560.001 · Archive via UtilityThe script creates a compressed ZIP archive of collected data using macOS's ditto command.
Products
KeychainThe macOS infostealer is designed to harvest a wide range of sensitive data, including keychain databases, login credentials, and live session cookies from 12 different browsers, over 200 browser extensions, and 16macOSNetskope Threat Labs is continuing its coverage of a ClickFix campaign targeting both Windows and macOS users.