ClickFix Campaign Uses Homebrew Installer To Spread Cuckoo Stealer On macOS

A new macOS malware campaign is abusing developer habits rather than software vulnerabilities. Security researchers have uncovered a ClickFix campaign distributing a new infostealer, Cuckoo Stealer, by impersonating the popular Homebrew package manager installer.

ClickFix is a social-engineering technique. Instead of hacking macOS protections directly, attackers trick users into running malicious commands themselves.

Victims visit a fake software page that looks legitimate and see an installation command with a convenient “Copy” button. After copying and pasting it into Terminal, the attack executes with full user permission.

In this incident, attackers created typosquatted domains closely resembling the official Homebrew site. The page displays what appears to be a normal installation command:

A legitimate Homebrew command downloads from a trusted GitHub source.

The malicious version quietly redirects traffic to an attacker-controlled server. The difference is only a few characters easy to miss at a glance.

The technique works particularly well against developers and administrators because they routinely install tools using curl and bash. Seeing familiar flags like -fsSL makes the command appear authentic.

After execution, the script runs a hidden authentication loop. It repeatedly prompts the user for a password using macOS Directory Services (dscl authonly) until the correct credentials are entered. Since the prompt looks identical to a normal sudo request, victims rarely suspect anything.

Once a valid password is captured, the script downloads a second-stage payload, Cuckoo Stealer, and launches it silently.

Researchers discovered multiple related domains hosted on shared infrastructure, indicating an organized operation rather than a single phishing page. Infrastructure searches also identified dozens of similar macOS-targeted ClickFix pages, showing a growing delivery trend.

Cuckoo Stealer Capabilities

Cuckoo Stealer is not a simple password grabber. It is a full-featured macOS infostealer combined with remote-access trojan (RAT) functionality.

Immediately after infection, the malware removes macOS quarantine attributes to avoid security warnings and installs persistence using a LaunchAgent named com.homebrew.brewupdater.plist. This allows the malware to run automatically whenever the user logs in.

The malware communicates with its command-and-control server over encrypted HTTPS using the X25519 key exchange, enabling attackers to control the device remotely.

Data theft is extensive. The malware targets:

• Browser passwords, cookies, and session tokens
• macOS Keychain credentials
• Apple Notes database
• Discord and Telegram sessions
• VPN and FTP configurations
• Desktop documents and screenshots
• More than 20 cryptocurrency wallets

It can also execute shell commands, browse files, reboot the system, and even delete itself to erase evidence.

Researchers noted a regional filtering feature: systems configured for certain CIS language settings are skipped, a behavior often seen in organized cybercrime groups.

The campaign highlights a key security lesson: modern attacks increasingly rely on human behavior.

The command looked legitimate, the page looked real, and macOS protections were never technically “bypassed.” Instead, users unknowingly authorized the infection themselves.

According to Hunt, as attackers shift toward social-engineering tactics like ClickFix, organizations must treat copy-paste commands from websites as potential threats and train users to verify sources before running Terminal commands.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.