A new attack targeting macOS users has been identified, leveraging the guise of a popular disk cleanup utility called ClickFix. This campaign employs various techniques to distribute malware and compromise user systems, including:
- Fake Disk Cleanup Utility: The attackers use a fake version of ClickFix to lure unsuspecting users into downloading malicious payloads.
- Multiple Campaigns:
- Loader Campaign: Utilizes legitimate websites like YouTube and Google Drive to host the initial payload.
- Script Campaign: Delivers shell scripts that download additional malware components from C2 servers.
- Helper Campaign: Deploys helper tools to exfiltrate data and maintain persistence on compromised systems.
- Persistence Mechanisms:
- The malware creates a plist file in
~/Library/LaunchAgentsto ensure it runs at system startup, maintaining long-term access.
- The malware creates a plist file in
- Staging Folders:
- Malicious files are staged in
/tmp/helperand/tmp/starter, masquerading as legitimate Google Update components.
- Malicious files are staged in
Key Components Identified
- Payloads: Multiple SHA-256 hashes of the payloads have been identified, indicating different variants of the malware.
- C2 Servers:
- `
Read the full article at Cyber Security News
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.

![[AINews] The Unreasonable Effectiveness of Closing the Loop](/_next/image?url=https%3A%2F%2Fmedia.nemati.ai%2Fmedia%2Fblog%2Fimages%2Farticles%2F600e22851bc7453b.webp&w=3840&q=75)



