Macfinger ClickFix Campaign: Detecting and Blocking Fake-CAPTCHA Malware Delivery on macOS

The SANS Internet Storm Center recently published an analysis of malicious software tied to the Macfinger ClickFix campaign — a distribution wave that abuses the now-infamous ClickFix social-engineering technique to compromise macOS systems. Unlike traditional drive-by downloads or exploit kits, ClickFix requires no vulnerability at all. The 'exploit' is the user: victims are presented with a fake CAPTCHA or 'browser verification' page that instructs them to open Terminal (or the Windows Run dialog in parallel Windows campaigns), paste a clipboard-loaded command, and press Enter. That single paste executes a staged downloader — typically a curl or base64-wrapped shell one-liner — that pulls the Macfinger payload directly into memory or onto disk.

For defenders, this campaign is a forcing function. The macOS install base in enterprise environments keeps growing, visibility into macOS process execution still lags Windows in most SOCs, and ClickFix converts your users into the delivery mechanism. Every control you have that assumes 'the user would never run that command' is now in scope for re-evaluation. There is no CVE to patch here — this is a technique problem, and it is being actively exploited in the wild right now.

Technical Analysis

What Is ClickFix?

ClickFix (and variants tracked as ClearFake and related fake-verification lures) hijacks legitimate websites or serves malicious ads that render a convincing 'Verify you are human' page. Instead of clicking a checkbox, the victim is told their browser or operating system requires a manual verification step:

The page silently copies a malicious command to the clipboard using JavaScript.
The victim is instructed to open Terminal on macOS (Spotlight → Terminal, or Cmd+Space) — or Win+R on Windows variants.
The victim pastes and executes the command, believing it completes a verification.

The pasted command is typically a base64-encoded or obfuscated one-liner that decodes into a curl ... | bash or bash -c "$(curl ...)" pattern — fetching a second-stage script from an attacker-controlled host and executing it in a single pipeline. No file is written before execution, so naive file-based AV sees little.

The Macfinger Payload

Per the SANS ISC analysis, the Macfinger campaign's delivered software follows the modern macOS infostealer playbook seen across the AMOS/Atomic-lineage ecosystem:

Staged retrieval: the initial paste executes a shell command that downloads a Mach-O binary or a secondary script (often osascript-based) from a typosquatted or compromised domain.
Reconnaissance and fingerprinting: system profiling via system_profiler, sw_vers, ioreg, and hardware UUID collection — consistent with the 'finger' (fingerprinting) naming.
Credential and data theft: targeting browser credential stores (Chrome/Edge/Firefox Login Data and Cookies SQLite databases), the macOS Keychain (frequently preceded by a fake osascript password prompt dialog to harvest the user's login password in cleartext), cryptocurrency wallet data, Telegram/session files, and desktop documents.
Staging and exfiltration: stolen data is compressed into a temporary working directory (commonly under /tmp/ or ~/Library/Application Support/) and exfiltrated via HTTP POST to the C2.
Persistence (in some observed chains): a LaunchAgent plist dropped into ~/Library/LaunchAgents/ and loaded via launchctl, masquerading as an Apple or legitimate vendor service.

Why This Works

The attack chain deliberately bypasses every control that inspects files before execution:

Gatekeeper and quarantine: the initial stage is text typed/pasted into a shell — it never receives a quarantine attribute. The downloaded second stage is fetched by curl, which does not apply the com.apple.quarantine xattr the way a browser download does.
User consent as execution: Terminal is a signed, trusted Apple binary. The user chose to run the command. From the OS's perspective, nothing malicious occurred at execution time.
Living-off-the-land: curl, bash, zsh, osascript, base64, and launchctl are all native, signed macOS utilities.

Exploitation Status

Actively distributed in the wild via compromised websites, malvertising, and SEO-poisoned landing pages.
No CVE is associated with this campaign — it is pure social engineering plus LOLBin abuse. Do not go hunting your vulnerability scanner output; this is solved with detection engineering, browser/email controls, and user guardrails.
Both macOS and Windows variants of ClickFix lures are in circulation; the Macfinger analysis focuses on the macOS payload, but Windows-side detection (PowerShell/mshta paste-execution) should be maintained in parallel.

Affected Populations

Any organization with macOS endpoints whose users browse the open web without strict web filtering — particularly roles with access to browser-stored credentials, SSH keys, cloud session tokens, or cryptocurrency wallets. Developers and finance staff are disproportionately targeted by stealer campaigns of this class.

Detection & Response

The highest-fidelity signals in this chain are: (1) an interactive shell launched from Terminal/iTerm executing a download-and-pipe-to-shell command, (2) base64 -d/-D combined with curl in a single command line, and (3) new user LaunchAgents loaded outside of software-deployment tooling. The rules below are tuned toward those behaviors.

Sigma Rules

YAML

---
title: macOS ClickFix Download-and-Execute via Shell Pipe
id: 3f7a2c19-8b4e-4d6a-9c21-5e8f0a1b3d47
status: experimental
description: Detects curl or wget output piped directly into a shell interpreter on macOS, the hallmark execution pattern of ClickFix paste-executed commands such as those used in the Macfinger campaign.
references:
  - https://isc.sans.edu/diary/rss/33368
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1059.004
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: macos
detection:
  selection_fetcher:
    CommandLine|contains:
      - 'curl '
      - 'wget '
  selection_pipe:
    CommandLine|contains:
      - '| sh'
      - '| bash'
      - '| zsh'
      - 'bash -c'
      - 'sh -c'
  condition: selection_fetcher and selection_pipe
falsepositives:
  - Legitimate developer install scripts (e.g., Homebrew, language tooling) — scope exclusions to known-good installer domains and MDM-managed software distribution
level: high
---
title: macOS Base64-Encoded Command Decode and Execute
id: 9c1e5b08-2f4d-4a7b-8e3c-6d0a9f2b4e51
status: experimental
description: Detects base64 decode operations chained to shell execution on macOS, consistent with obfuscated ClickFix clipboard payloads that decode a hidden curl command before piping it to a shell.
references:
  - https://isc.sans.edu/diary/rss/33368
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection_decode:
    CommandLine|contains:
      - 'base64 -d'
      - 'base64 -D'
      - 'base64 --decode'
  selection_exec:
    CommandLine|contains:
      - '| sh'
      - '| bash'
      - '| zsh'
      - 'eval'
      - 'curl'
  condition: selection_decode and selection_exec
falsepositives:
  - Rare; some build pipelines and MDM scripts decode embedded payloads — baseline developer workstations separately
level: high
---
title: macOS LaunchAgent Persistence Loaded via launchctl
id: 5b2d8e71-4c6f-4a9d-b1e3-7f5c2a8d0e64
status: experimental
description: Detects launchctl loading a property list from a user-writable LaunchAgents directory, a persistence mechanism observed in macOS stealer campaigns including Macfinger-lineage tooling.
references:
  - https://isc.sans.edu/diary/rss/33368
  - https://attack.mitre.org/techniques/T1543/001/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1543.001
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    Image|endswith: '/launchctl'
  selection_args:
    CommandLine|contains:
      - 'load'
      - 'bootstrap'
  selection_path:
    CommandLine|contains:
      - 'LaunchAgents'
  condition: selection_img and selection_args and selection_path
falsepositives:
  - Legitimate user-space agents (browser updaters, conferencing tools, MDM agents) — tune against your approved software inventory and alert on unknown plist names
level: medium

KQL — Microsoft Sentinel / Defender

// Hunt: ClickFix-style download-and-execute on macOS endpoints (MDE for Mac)
let Lookback = 14d;
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("bash", "sh", "zsh", "curl", "osascript")
| where ProcessCommandLine has_any ("curl", "wget")
    and ProcessCommandLine has_any ("| sh", "| bash", "| zsh", "bash -c", "sh -c", "base64 -d", "base64 -D")
| extend SuspiciousCombo = true
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId, ReportId
| order by TimeGenerated desc;
// Hunt: interactive Terminal/iTerm spawning network fetchers — user was socially engineered
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ ("Terminal", "iTerm2", "com.apple.Terminal")
| where FileName in~ ("curl", "wget", "osascript", "base64")
| where ProcessCommandLine has_any ("http://", "https://", "base64")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc;
// Hunt: new user LaunchAgent plist creation followed by launchctl load
DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FolderPath has "/Library/LaunchAgents/"
| where ActionType == "FileCreated"
| where InitiatingProcessFileName !in~ ("MDMClient", "jamf", "softwareupdated")
| project TimeGenerated, DeviceName, AccountName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

Velociraptor VQL

VQL — Velociraptor

-- Macfinger / ClickFix hunt: live processes with download-pipe-to-shell
-- or base64-decode patterns, plus user LaunchAgent persistence artifacts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(curl|wget).*(\|\s*(ba|z)?sh|bash -c|sh -c)'
   OR CommandLine =~ '(?i)base64\s+(-d|-D|--decode)'

VQL — Velociraptor

-- Enumerate user-level LaunchAgents for persistence triage
SELECT FullPath, Mtime, Size,
       read_file(filename=FullPath, length=4096) AS PlistHead
FROM glob(globs='/Users/*/Library/LaunchAgents/*.plist')
ORDER BY Mtime DESC

Triage & Hardening Script (macOS)

Bash / Shell

#!/bin/bash
# Macfinger/ClickFix triage and hardening — run via MDM (Jamf/Kandji/Intune) or locally with sudo
# 1) Inventory user LaunchAgents and flag recently created/modified plists
echo "=== LaunchAgents (user scope) ==="
for d in /Users/*/Library/LaunchAgents; do
  [ -d "$d" ] && ls -lT "$d" 2>/dev/null
done

# 2) Flag plists created in the last 14 days
echo "=== Recently created LaunchAgents (14d) ==="
find /Users/*/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons \
  -name '*.plist' -mtime -14 2>/dev/null

# 3) Look for stealer staging artifacts in common working dirs
echo "=== Suspicious staging artifacts ==="
find /tmp /var/tmp /Users/*/Library/Application\\ Support \
  -maxdepth 2 -type d -mmin -10080 \
  \( -iname '*out*' -o -iname '*grab*' -o -iname '*data*' \) 2>/dev/null | head -50

# 4) Audit shell history for ClickFix-style pasted commands
echo "=== Shell history: download-pipe patterns ==="
for h in /Users/*/.zsh_history /Users/*/.bash_history; do
  [ -f "$h" ] && grep -aE 'curl.*\| *(ba|z)?sh|base64 (-d|-D)' "$h" 2>/dev/null | tail -20
done

# 5) Check for unsigned / recently dropped executables outside standard paths
echo "=== Recent executables in user-writable paths ==="
find /Users/*/Downloads /tmp /var/tmp /Users/*/Library \
  -type f -perm +111 -mtime -14 2>/dev/null | head -50

# 6) Report active network connections for suspicious processes
echo "=== Active connections (curl/osascript/unknown) ==="
lsof -i -nP 2>/dev/null | grep -Ei 'curl|osascript|python|node' | head -30

Remediation

There is no patch for ClickFix — remediation is architectural and behavioral:

Contain the endpoint immediately. If a paste-executed command was run, assume credential compromise: isolate the host via your EDR, and treat every secret reachable from that machine (browser-stored passwords, Keychain entries, SSH keys, cloud CLI tokens, session cookies) as burned. Rotate them. Session-token theft enables MFA bypass — invalidate active sessions in your IdP, not just passwords.
Deploy the detections above. At minimum, alert on fetcher-piped-to-shell and interactive-Terminal-spawning-curl patterns. These are low-noise, high-signal behaviors on macOS.
Block paste-execution at the source. Use DNS/web filtering to block newly registered domains and known ClickFix lure infrastructure; deploy browser isolation for high-risk browsing. Instruct users explicitly: no legitimate website will ever ask you to open Terminal, paste a command, or press Win+R to 'verify' anything. Put this exact sentence in your awareness training — it is the single most effective countermeasure.
Reduce blast radius. Enforce a password manager (which does not auto-fill on attacker-controlled lookalike domains), remove local admin rights, restrict Keychain access prompts, and deploy an EDR with macOS behavioral coverage (MDE, CrowdStrike, SentinelOne, Jamf Protect, or equivalent).
Monitor persistence surfaces. Continuously inventory ~/Library/LaunchAgents across the fleet; alert on plists not present in your approved software baseline.
Forensics before wipe. Before reimaging a confirmed victim, capture shell histories, Unified Logs, browser histories, and the plists/staging artifacts enumerated by the script above — the IOCs in them feed your blocklists and retro-hunts.

If your team needs help scoping a suspected ClickFix/Macfinger compromise — particularly credential-rotation scope and stealer artifact triage — our IR team handles these engagements routinely.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub