Threat reportPhishingTL-2026-4904
ClickFix Copy-Paste Terminal Campaigns Targeting macOS and Windows: MacSync Stealer Lures and DPRK UNC1069 Multi-Stage Intrusions (Objective-See: Stopped at ⌘+V)
ClickFix Copy-Paste Terminal Campaigns Targeting macOS and (TL-2026-4904), also tracked as ClickFix, is a high-severity phishing campaign, first published 2026-10-31. It is attributed to UNC1069 (North Korea) with medium confidence, affects Apple macOS (Terminal, iTerm2, Ghostty, Kitty, Warp), maps to 22 MITRE ATT&CK techniques (T1036.005, T1056.001, T1059.002), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 1UNC1069
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-4904
- Threat ID
- TL-2026-4904
- Also known as
- ClickFix, InstallFix, Malicious Copy and Paste
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- UNC1069
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, financial services, technology, software development, venture capital
- Target regions
- Global, North America, 005 - South America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in ClickFix Copy-Paste Terminal Campaigns Targeting macOS and
Malware and tooling: HIDDENCALL, MacSync, SUGARLOADER, WAVESHAPER, telegram, BlockBlock
How ClickFix Copy-Paste Terminal Campaigns Targeting macOS and works
ClickFix tricks users into pasting attacker-supplied commands (for example base64-encoded payloads piped to zsh) into a terminal, which bypasses macOS Gatekeeper and Notarization because no app is launched. Opportunistic actors use it to deliver the MacSync stealer, and the North Korea-nexus actor UNC1069 used it in a February 2026 crypto-sector intrusion that deployed seven macOS malware families.
ClickFix is a social-engineering technique in which the victim copies attacker-controlled commands and pastes them into a terminal, so the malicious code runs with the user's privileges inside an existing, trusted terminal session. On macOS this sidesteps Gatekeeper and Notarization, which only gate launched applications. Objective-See (Patrick Wardle, 2026-02-15) documents the basic pattern 'echo "..." | base64 -D | zsh' and the lure channels seen in the wild: Google-sponsored search results, articles impersonating Apple Support, LLM-hosted content such as public Claude artifacts, and fake virtual-meeting troubleshooting pages.
Opportunistic campaigns: Moonlock Lab reported (as referenced by Objective-See, incident date 2026-02-11) a campaign that abused public Claude artifacts promoted through hijacked Google Ads accounts, with more than 15,000 views, to deliver the MacSync infostealer. The Hacker News summarizes earlier MacSync waves: a fake ChatGPT Atlas browser reached through Google sponsored search in November 2025, and malvertising for 'how to clean up your Mac' leading to shared ChatGPT conversations and GitHub-themed landing pages in December 2025. A February 2026 MacSync variant uses dynamic AppleScript payloads and in-memory execution. MacSync harvests credentials, keychain databases, files and cryptocurrency wallet seed phrases. Researchers note the technique is effective against developers because 'curl | sh' is a legitimate installation pattern.
State-nexus use: Google Threat Intelligence / Mandiant (2026-02-09) describes UNC1069, a financially motivated cluster with a suspected North Korea nexus, targeting the cryptocurrency sector. The intrusion began with a compromised Telegram account of an executive, moved to a Calendly link and a spoofed Zoom page (zoom.uswe05.us) with a reported deepfake video of another company's CEO, then used a fake audio-problem pretext to push ClickFix commands for macOS (curl -A audio ... | zsh) and Windows (mshta). Mandiant recovered seven macOS families on one host: WAVESHAPER (C++ backdoor), HYPERCALL (Go downloader, RC4-encrypted config, WebSocket C2), HIDDENCALL (Go hands-on-keyboard backdoor loaded reflectively via NSCreateObjectFileImageFromMemory), DEEPBREATH (Swift data miner that manipulates the TCC database to steal Keychain, browser, Telegram and Apple Notes data), SUGARLOADER (C++ downloader with a LaunchDaemon), CHROMEPUSH (browser-extension/native-messaging data miner for keystrokes, cookies, credentials and screenshots) and SILENCELIFT (minimal backdoor that can interrupt Telegram when run as root). Mandiant could not independently verify the use of AI models for the deepfake in this incident.
Defensive notes: the Objective-See article itself lists no IOCs. The IOCs in this record come from the Mandiant report. Detection angles are paste-into-terminal monitoring (BlockBlock v2.3.0 Paste Protection hooks global Command+V events via NSEvent and checks the frontmost terminal bundle ID for Terminal, iTerm2, Ghostty, Kitty and Warp; it SIGSTOPs the terminal and shows the clipboard, with optional heuristics for length, pipes, base64, curl and osascript; it does not cover right-click paste), curl-to-zsh pipelines, softwareupdate/system_profiler masquerading, TCC.db modification, LaunchDaemon creation under /Library/LaunchDaemons, and Chrome NativeMessagingHosts writes.
MITRE ATT&CK techniques used in TL-2026-4904
Defense Evasion
T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218.005 System Binary Proxy Execution: Mshta; T1620 Reflective Code Loading; T1684.001 Impersonation
Collection
T1056.001 Input Capture: Keylogging; T1113 Screen Capture
Execution
T1059.002 Command and Scripting Interpreter: AppleScript; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.004 User Execution: Malicious Copy and Paste
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1573.001 Encrypted Channel: Symmetric Cryptography
Discovery
T1082 System Information Discovery
Persistence
T1176.001 Software Extensions: Browser Extensions; T1543.004 Create or Modify System Process: Launch Daemon
Credential Access
T1539 Steal Web Session Cookie; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
defense-impairment
T1553.001 Subvert Trust Controls: Gatekeeper Bypass
Initial Access
T1566.003 Phishing: Spearphishing via Service
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.008 Acquire Infrastructure: Malvertising
Affected products and versions in ClickFix Copy-Paste Terminal Campaigns Targeting macOS and
Remediation for ClickFix Copy-Paste Terminal Campaigns Targeting macOS and
Immediate actions
- Block and sinkhole the network IOCs listed (mylingocoin.com, supportzm.com, zmsupport.com, breakdream.com, dreamdie.com, support-zoom.us, cmailer.pro, zoom.uswe05.us)
- Hunt macOS endpoints for the file paths and hashes in the IOC list, especially /Library/LaunchDaemons/com.apple.system.updater.plist and /Library/OSRecovery/SystemUpdater
- If a user pasted an unknown command into a terminal, treat the host as compromised: isolate it, rotate Keychain, browser, Telegram and crypto-wallet credentials and revoke sessions
- Alert on curl or other downloaders piped to zsh/sh/bash and on 'echo <base64> | base64 -D | zsh' launched from interactive terminals
Workarounds
- Enable BlockBlock Paste Protection with heuristic filtering to reduce false positives
- Where feasible, restrict Terminal use on non-developer endpoints via MDM
- On Windows, monitor mshta.exe, msdt.exe and pnputil.exe launched from user-pasted command lines
Longer-term hardening
- Train staff and developers that no legitimate support, meeting or installer flow requires pasting commands into a terminal
- Deploy paste-into-terminal protection such as Objective-See BlockBlock v2.3.0 Paste Protection Mode, and EDR with behavioral detection for terminal-spawned download-and-execute chains
- Restrict who can modify the TCC database and monitor Chrome NativeMessagingHosts and /Library/Caches writes
- Verify meeting-invite and executive-contact requests out of band, including contacts on Telegram, and treat unexpected screen-share or audio-troubleshooting requests as suspicious
- Review Google Ads and search-result exposure for brand and software-install queries
Timeline of ClickFix Copy-Paste Terminal Campaigns Targeting macOS and
- November 2025 (exact day not stated): MacSync ClickFix wave uses a fake OpenAI ChatGPT Atlas browser promoted via Google sponsored search and a fake Google Sites download page that leads to a Terminal command.
- December 2025 (exact day not stated): Google malvertising for 'how to clean up your Mac' leads to shared ChatGPT conversations and GitHub-themed landing pages with Terminal commands.
- February 2026 (exact day not stated): MacSync variant with dynamic AppleScript payloads and in-memory execution is seen in ClickFix lures targeting Belgium, India and the Americas.
- Google Threat Intelligence Group / Mandiant publishes the UNC1069 report: Telegram, fake Zoom and deepfake lure, ClickFix audio-fix commands, and seven macOS malware families on one host.
- BleepingComputer reports the DPRK macOS malware campaign, naming WAVESHAPER, HYPERCALL, HIDDENCALL, SILENCELIFT, DEEPBREATH, SUGARLOADER and CHROMEPUSH.
- Moonlock Lab incident referenced by Objective-See: ClickFix campaign abusing public Claude artifacts and Google Ads to deliver the MacSync stealer.
- Objective-See (Patrick Wardle) publishes 'ClickFix: Stopped at ⌘+V' and releases BlockBlock v2.3.0 with Paste Protection Mode that intercepts Command+V into terminals.
Sources cited for ClickFix Copy-Paste Terminal Campaigns Targeting macOS and
- ClickFix: Stopped at ⌘+V (Objective-See, Patrick Wardle)
- UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering (Google Threat Intelligence Group / Mandiant)
- North Korean hackers use new macOS malware in crypto-theft attacks (BleepingComputer)
- BlockBlock (Objective-See) - Paste Protection in v2.3.0
- ClickFix Campaigns Spread MacSync macOS Infostealer (The Hacker News)
- MacSync Infostealer via ClickFix Claude Artifact Abuse (Anvilogic)
- How a Google Search for Claude Led to MacSync (Huntress)
- Stealer season: Why MacSync and AMOS are the biggest threats to your Mac (Moonlock)
- North Korea Uses ClickFix to Target macOS Users' Data (Dark Reading)
- North Korean hackers targeted crypto exec with ClickFix (The Record)
Detection coverage for TL-2026-4904
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4904 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4904
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.