New ClickFix Attack Targets macOS Users With Fake Disk Cleanup and Utility Lures

A new attack targeting macOS users has been identified, leveraging the guise of a popular disk cleanup utility called ClickFix. This campaign employs various techniques to distribute malware and compromise user systems, including:

1. Fake Disk Cleanup Utility: The attackers use a fake version of ClickFix to lure unsuspecting users into downloading malicious payloads.
2. Multiple Campaigns:
   • Loader Campaign: Utilizes legitimate websites like YouTube and Google Drive to host the initial payload.
   • Script Campaign: Delivers shell scripts that download additional malware components from C2 servers.
   • Helper Campaign: Deploys helper tools to exfiltrate data and maintain persistence on compromised systems.
3. Persistence Mechanisms:
   • The malware creates a plist file in ~/Library/LaunchAgents to ensure it runs at system startup, maintaining long-term access.
4. Staging Folders:
   • Malicious files are staged in /tmp/helper and /tmp/starter, masquerading as legitimate Google Update components.

Key Components Identified

• Payloads: Multiple SHA-256 hashes of the payloads have been identified, indicating different variants of the malware.
• C2 Servers:
  • `

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.