Search/Fake Claude search results lure Mac users into ClickFix attack
● Story

Fake Claude search results lure Mac users into ClickFix attack

The Australian Cyber Security Center (ACSC) is warning organizations of an ongoing malware campaign using the ClickFix social engineering technique to distribute  the Vidar Stealer info-stealing malware. [...]

View graph Export
CVEs
0
Highest CVSS
—
In KEV
0
Sources
4
Connections
6 relationships
Fake Claude search results lure Mac users into ClickFix attack
Researchers found that cybercriminals are using sponsored search results and shared Claude chats to lure victims into a typical ClickFix attack to install malware on macOS devices. ClickFix is a social engineering method that tricks users into infecting their own device with malware. Users are instructed to run specific commands that will download malware, usually an infostealer. The researchers found that when users search for terms like “Claude Mac download,” they may see sponsored Google results that appear to go to the legitimate claude.ai domain. In reality, the ads resolve to real Claude shared chats, set up to look like official “Claude Code on Mac” or Apple Support guides. Independent research by BleepingComputer found another chat serving the same purpose. The chat instructs victims to open Terminal and paste a base64‑encoded command, which pulls a loader shell script from attacker‑controlled infrastructure and runs it in memory. The script then profiles the system, pulls down a second-stage payload and runs it through osascript, macOS’s built-in scripting engine. This gives the attacker remote code execution (RCE) without ever dropping a traditional application or binary. This results in a MacSync‑style payload that harvests browser credentials, cookies, Keychain contents, and crypto wallet data, bundles it, and sends all that information over HTTP to attacker servers. How to stay safe Users running macOS Tahoe 26.4 and later will see warnings about possible ClickFix attacks, but other users still have to rely on common sense. With ClickFix running rampant and inventing new methods all the time, it’s important to stay aware, cautious, and protected. Slow down. Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy and paste code. Attackers rely on urgency to bypass your critical thinking, so be cautious of pages urging immediate action. Sophisticated ClickFix pages add countdowns, user counters, or other pressure tactics to make you act quickly. Avoid running commands or scripts from untrusted sources. Never run code or commands copied from websites, emails, or messages unless you trust the source and understand what the action does. Verify instructions independently. If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding. Limit copy and paste for commands. Manually typing commands instead of copy and paste can reduce the risk of unknowingly running malicious payloads hidden in copied text. Secure your devices. Use an up-to-date, real-time anti-malware solution with web protection. Malwarebytes blocks connections to unsafe sites like these. Educate yourself on evolving attack techniques. Understanding that attacks may come from unexpected places helps maintain vigilance. Keep reading our blog! Stay away from sponsored ads in search results. Anyone can buy them and make them look legitimate. Pro tip: The free Malwarebytes Browser Guard extension warns you when a website tries to copy something to your clipboard. Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
malwarebytes.comMay 12, 2026extracted
Attackers Combine ClickFix With PySoxy Proxying to Maintain Persistence
Cybercriminals have combined ClickFix attacks with PySoxy, a 10-year-old open-source Python SOCKS5 proxy, to maintain persistence on victims’ machines without malware, even after attempts at removal. The campaign has been detailed by cybersecurity researchers at ReliaQuest, who warned that it shows that ClickFix attacks are moving beyond one-time user execution into modular post-exploitation, making the attacks harder to identify and contain. ClickFix, is a social engineering tactic which tricks users into unwittingly running malicious commands or downloading harmful payloads onto their own machines. It has become a widely deployed method of distributing malware or stealing login credentials. ReliaQuest said in a 12 May blog that the ClickFix attack they investigated stood out because blocking the initial access the attackers acquired with ClickFix didn’t necessarily stop the intrusion. Instead, the proxy tool featured a local persistence mechanism which allowed the activity to keep restarting through a scheduled task. Deliberate Preparation for Continued Access The attackers were careful about the introduction of PySoxy, which was not launched immediately following the initial ClickFix compromise. Instead, the intruder took time to gather information about the environment, to identify potential follow-on targets, and confirm the host could communicate with attacker-controlled staging infrastructure. Only then was PySoxy introduced as part of the attack. “That sequence matters because it shows deliberate preparation for continued access, not just one-off reconnaissance,” said Ivan Righi, senior cyber threat intelligence officer analyst at ReliaQuest. It was only after the proxy had successfully established a connection to the control server operated by the attackers that the final payload was introduced. Researchers observed attackers attempting this via PowerShell and Python scripts, while they also tried to simply drop a Remote Access Trojan (RAT). Both channels were blocked by endpoint controls, but the persistence mechanism still mattered because it allowed repeated re-execution attempts. “For response teams, this means that ClickFix incidents that include persistence and secondary tooling should be treated as active compromise investigations, with host isolation, full artifact review, and validation that all access paths and staged components have been removed,” said Righi. To counter similar ClickFix attacks which might have bypassed detection, ReliaQuest recommended that security teams review scheduled tasks, analyze Python artifacts, and hunt for proxy-style Python command lines rather than treating a blocked C2 connection as containment. Earlier this month, the Australian Cyber Security Centre (ACSC) issued a warning over a widespread campaign using ClickFix in an attempt to distribute malware to infrastructure providers and other organizations.
infosecurity-magazine.comMay 12, 2026extracted
Australian Cyber Security Centre Issues Alert Over ClickFix Attacks
The Australian Cyber Security Centre (ACSC) has issued a warning about a malicious cyber campaign which exploits the ClickFix social engineering technique to deliver potent password-stealing malware. In the alert, issued on May 7, Australian Signals Directorate’s (ADC) ACSC warned that the Vidar Stealer campaign is targeting infrastructure and organizations across multiple sectors. Vidar Stealer is a form of infostealer which primarily targets Microsoft Windows users and is designed to steal sensitive information from victims. Information it targets includes usernames, passwords, credit card data, cryptocurrency wallets, browser history, multi-factor authentication (MFA) tokens and more. The malware has been active since 2018. The ACSC has warned that a widespread campaign to distribute the malware combines compromised WordPress sites with ClickFix techniques. Users are directed to compromised WordPress sites, which are then used to redirect to sites which are designed to deliver the malware. The sites leverage ClickFix, a social engineering tactic which tricks users into unwittingly running malicious commands or downloading harmful payloads onto their own machines. In this campaign, the ClickFix technique uses fake CAPTCHA verification prompts to convince users to execute malicious commands or scripts. Because the user is entering command, it commonly bypasses traditional cybersecurity protections. Once deployed, Vidar Stealer employs defense‑evasion techniques, including self‑deletion of the initial executable, which enables the malware to persist and operate primarily in memory, making it harder to detect and remove. How to Mitigate Vidar Stealer Attacks The ACSC recommends that organizations follow guidance issued in the alert to counter the threat of Vidar Stealer and other malware campaigns distributed by ClickFix attacks. The advice includes: Restrict execution of unauthorised or unapproved applications, including downloaded executables and scripts Ensure WordPress, plugins, themes, browsers, and scripting engines are fully patched and up to date Block or limit clipboard write access from browser-based JavaScript and untrusted web content Ensure operating systems are kept fully patched with the latest security updates. Apply patches promptly to endpoints and servers, particularly those exposed to the internet Enforce phishing-resistant MFA
infosecurity-magazine.comMay 8, 2026extracted
Australia warns of ClickFix attacks pushing Vidar Stealer malware
The Australian Cyber Security Center (ACSC) is warning organizations of an ongoing malware campaign using the ClickFix social engineering technique to distribute the Vidar Stealer info-stealing malware. ClickFix is a social engineering attack technique that tricks users into executing malicious commands, usually through fake CAPTCHA or browser verification prompts displayed on compromised or malicious websites. The attack typically tricks users into executing PowerShell commands to bypass security controls and deliver malware, typically info-stealers. Australian organizations and infrastructure entities are being targeted in attacks that involve compromised WordPress websites that redirect to malicious payloads. Users visiting these websites are shown a fake Cloudflare verification or CAPTCHA prompt that instructs them to copy and manually execute a malicious PowerShell command on their system, which leads to a Vidar Stealer infection. “The Australian Signals Directorate’s Australian Cyber Security Center (ASD's ACSC) has observed ClickFix-associated activity leveraging WordPress-hosted infrastructure to distribute the Vidar Stealer malware,” reads the agency's advisory. Vidar Stealer is an information-stealing malware family and malware-as-a-service (MaaS) operation that emerged in late 2018. It gradually became a popular choice among cybercriminals for its cost-effectiveness, ease of deployment, and broad data theft capabilities. It targets browser passwords, cookies, cryptocurrency wallets, autofill information, and system details. It has been observed in ClickFix attacks, promoted through Windows fixes, TikTok videos, and GitHub. Last year, the developer released a new version with upgraded capabilities. ACSC notes that Vidar deletes its executable after launching on the infected device and then operates from system memory, reducing forensic artifacts. It retrieves a command-and-control (C2) address via “dead-drop” URLs using public services like Telegram bots and Steam profiles, a tactic that has been widely used in the past but which remains effective. ACSC recommends that organizations restrict PowerShell execution and implement application allow-listing to reduce the risk from these attacks. WordPress site administrators are also advised to apply available security updates for themes and add-ons, and to remove any unused themes/plugins from their platforms. ACSC's security bulletin provides indicators of compromise (IoCs) for these attacks, allowing organizations to set up defenses or detect intrusions. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
bleepingcomputer.comMay 7, 2026extracted
Related Stories
1
Fake Software Tutorials on TikTok Spread Vidar Stealer
Short-form video platforms like TikTok and Instagram Reels have become the latest way cybercriminals spread malware. We’ve already seen attackers move away from traditional phishing emails and toward tactics that trick people into installing malware themselves. Now they’re being lured with slick social media videos that promise free Spotify Premium, free Windows activation, or free Microsoft Office, but instead leave people with infostealers on their Windows devices. Researchers at ReversingLabs uncovered two active campaigns that use short videos to trick users into running dangerous PowerShell commands or visiting malicious download sites. Similar campaigns have been reported by other researchers and national cybersecurity agencies, suggesting a growing trend: Cybercriminals are learning how to use social media algorithms just as effectively as marketers. In true social media fashion, the videos on platforms like TikTok and Instagram Reels claim to solve a problem you didn’t know you had. The catch is that following the instructions delivers malware to your device. How the scam works The first campaign looks deceptively professional. Accounts with names like “windows.tips” or “windows.insights” use Windows-style branding and post polished tutorial videos that resemble genuine tech support content. The videos are tagged with Windows and Office-related keywords so they appear alongside legitimate troubleshooting and tips content. The videos promise to unlock Spotify Premium, Microsoft Office, or Windows for free. Viewers are then guided through step-by-step instructions that include opening Powershell, a legitimate Windows admin tool, and pasting in commands. Those commands download and run malware, much like the ClickFix scams we’ve covered before. The malware was identified as Vidar, an infostealer designed to steal sensitive informtion from infected devices. Vidar commonly targets: Saved browser passwords Autofill data Browser cookies Cryptocurrency wallets Two-factor authentication (2FA) data TOR browser data The stolen information is then sent back to servers controlled by the attackers. How to stay safe Research into similar TikTok-based attacks shows these scripts commonly add exclusions to Windows Defender, making it harder for security software to detect future malicious activity. Fortunately, there are a few simple ways to protect yourself: Only download software from official vendor websites. Be skeptical of “free”, cracked, or unofficial versions of paid software. Don’t follow instructions on a webpage without thinking them through, especially if the page asks you to run commands on your device or copy and paste code. Many ClickFix pages use countdowns, fake user counters, or other pressure tactics to make you act quickly. Check that downloaded files match what you expected to download. Verify a file’s publisher and digital signature before you run it. On Windows, you can usually check this by right-clicking the file, selecting Properties > Digital Signatures. Keep in mind that a valid signature does not guarantee a file is safe, but missing or suspicious signatures are often a red flag. Use a real-time, up-to-date anti-malware solution to block malware like infostealers before it runs. Pro tip: If you’re unsure whether a video, message, or website is legitimate, you can ask Malwarebytes Scam Guard about it. It can help identify suspicious content and advise you on what to do next. Image courtesy of ReversingLabs From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
2 shared
Jun 11, 2026