For years, CAPTCHA checks and “prove you’re human” prompts have been mildly annoying but harmless parts of web browsing.
Today, attackers are weaponizing that familiarity into a powerful social engineering technique called ClickFix, and a new campaign shows this tactic is now firmly targeting macOS users.
Instead of exploiting software bugs, threat actors trick users into infecting their own Macs by following fake “verification” instructions in Terminal.
ClickFix is a social engineering method where attackers hide a malicious command inside a seemingly routine security or verification step.
Rather than drop a payload automatically, they convince the victim to copy and run the command themselves.
On a compromised or fake site, the user might be told that a CAPTCHA failed, the browser needs a security update, or an extra check is required to continue. The page then walks them through steps that sound technical but “normal” to a non‑expert.
Mac ClickFix Verification Trap
On Windows, classic ClickFix instructions tell users to copy a text snippet, open the Run dialog, paste it, and press Enter. That snippet quietly downloads and executes malware under the user’s own account.
Because the victim is following instructions from a page they believe is trustworthy, built‑in warnings are ignored as part of the process.
Over time, attackers have evolved related techniques such as FileFix and ConsentFix that abuse file explorer actions or cloud account consent flows, all based on the same idea, get the user to perform the malicious step willingly instead of bypassing security controls directly.
Until recently, most documented ClickFix campaigns focused on Windows. Mac users saw fewer cases, which fed the persistent myth that “macOS is safer.”
The latest activity shows that assumption no longer holds: the same persuasion‑driven techniques now target Apple’s ecosystem and its users’ valuable data.
In the macOS-focused campaign, the attack still starts with a fake CAPTCHA or verification gate.
To “prove you’re human” or “fix an error,” the page instructs the user to copy a specific command, open the Terminal app, paste the command, and press Enter.
To a non‑technical user, this might look like a legitimate support workaround. In reality, this single step is all the attacker needs, kaspersky said.
Once executed, the command silently downloads a malicious disk image (DMG) from an attacker‑controlled server and saves it in the /tmp directory under a random name.
Next, the script mounts the DMG without showing it in Finder or on the desktop, so the victim never sees a new drive appear. The script then scans the hidden disk image for an application bundle or installer package and automatically launches it.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
