# ClickFix Copy-Paste Terminal Campaigns Targeting macOS and Windows: MacSync Stealer Lures and DPRK UNC1069 Multi-Stage Intrusions (Objective-See: Stopped at ⌘+V)

> ClickFix tricks users into pasting attacker-supplied commands (for example base64-encoded payloads piped to zsh) into a terminal, which bypasses macOS Gatekeeper and Notarization because no app is launched. Opportunistic actors use it to deliver the MacSync stealer, and the North Korea-nexus actor UNC1069 used it in a February 2026 crypto-sector intrusion that deployed seven macOS malware families.

- **Published:** 2026-10-31T13:28:16Z
- **Last reviewed:** 2026-10-31T13:28:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4904
- **ID:** TL-2026-4904
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** UNC1069 (North Korea)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ClickFix is a social-engineering technique in which the victim copies attacker-controlled commands and pastes them into a terminal, so the malicious code runs with the user's privileges inside an existing, trusted terminal session. On macOS this sidesteps Gatekeeper and Notarization, which only gate launched applications. Objective-See (Patrick Wardle, 2026-02-15) documents the basic pattern 'echo "..." | base64 -D | zsh' and the lure channels seen in the wild: Google-sponsored search results, articles impersonating Apple Support, LLM-hosted content such as public Claude artifacts, and fake virtual-meeting troubleshooting pages.

Opportunistic campaigns: Moonlock Lab reported (as referenced by Objective-See, incident date 2026-02-11) a campaign that abused public Claude artifacts promoted through hijacked Google Ads accounts, with more than 15,000 views, to deliver the MacSync infostealer. The Hacker News summarizes earlier MacSync waves: a fake ChatGPT Atlas browser reached through Google sponsored search in November 2025, and malvertising for 'how to clean up your Mac' leading to shared ChatGPT conversations and GitHub-themed landing pages in December 2025. A February 2026 MacSync variant uses dynamic AppleScript payloads and in-memory execution. MacSync harvests credentials, keychain databases, files and cryptocurrency wallet seed phrases. Researchers note the technique is effective against developers because 'curl | sh' is a legitimate installation pattern.

State-nexus use: Google Threat Intelligence / Mandiant (2026-02-09) describes UNC1069, a financially motivated cluster with a suspected North Korea nexus, targeting the cryptocurrency sector. The intrusion began with a compromised Telegram account of an executive, moved to a Calendly link and a spoofed Zoom page (zoom.uswe05.us) with a reported deepfake video of another company's CEO, then used a fake audio-problem pretext to push ClickFix commands for macOS (curl -A audio ... | zsh) and Windows (mshta). Mandiant recovered seven macOS families on one host: WAVESHAPER (C++ backdoor), HYPERCALL (Go downloader, RC4-encrypted config, WebSocket C2), HIDDENCALL (Go hands-on-keyboard backdoor loaded reflectively via NSCreateObjectFileImageFromMemory), DEEPBREATH (Swift data miner that manipulates the TCC database to steal Keychain, browser, Telegram and Apple Notes data), SUGARLOADER (C++ downloader with a LaunchDaemon), CHROMEPUSH (browser-extension/native-messaging data miner for keystrokes, cookies, credentials and screenshots) and SILENCELIFT (minimal backdoor that can interrupt Telegram when run as root). Mandiant could not independently verify the use of AI models for the deepfake in this incident.

Defensive notes: the Objective-See article itself lists no IOCs. The IOCs in this record come from the Mandiant report. Detection angles are paste-into-terminal monitoring (BlockBlock v2.3.0 Paste Protection hooks global Command+V events via NSEvent and checks the frontmost terminal bundle ID for Terminal, iTerm2, Ghostty, Kitty and Warp; it SIGSTOPs the terminal and shows the clipboard, with optional heuristics for length, pipes, base64, curl and osascript; it does not cover right-click paste), curl-to-zsh pipelines, softwareupdate/system_profiler masquerading, TCC.db modification, LaunchDaemon creation under /Library/LaunchDaemons, and Chrome NativeMessagingHosts writes.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1583.008 Acquire Infrastructure: Malvertising
- T1566.003 Phishing: Spearphishing via Service
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.002 Command and Scripting Interpreter: AppleScript
- T1543.004 Create or Modify System Process: Launch Daemon
- T1176.001 Software Extensions: Browser Extensions
- T1553.001 Subvert Trust Controls: Gatekeeper Bypass
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1218.005 System Binary Proxy Execution: Mshta
- T1684.001 Impersonation
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1555.001 Credentials from Password Stores: Keychain
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.001 Input Capture: Keylogging
- T1113 Screen Capture
- T1082 System Information Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography

## Sources

- [ClickFix: Stopped at ⌘+V (Objective-See, Patrick Wardle)](https://objective-see.org/blog/blog_0x85.html)
- [UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering (Google Threat Intelligence Group / Mandiant)](https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering)
- [North Korean hackers use new macOS malware in crypto-theft attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/north-korean-hackers-use-new-macos-malware-in-crypto-theft-attacks/)
- [BlockBlock (Objective-See) - Paste Protection in v2.3.0](https://github.com/Objective-see/BlockBlock)
- [ClickFix Campaigns Spread MacSync macOS Infostealer (The Hacker News)](https://thehackernews.com/2026/03/clickfix-campaigns-spread-macsync-macos.html)
- [MacSync Infostealer via ClickFix Claude Artifact Abuse (Anvilogic)](https://www.anvilogic.com/threat-reports/macsync-infostealer-via-clickfix-claude-artifact-abuse)
- [How a Google Search for Claude Led to MacSync (Huntress)](https://www.huntress.com/blog/fake-claude-macsync)
- [Stealer season: Why MacSync and AMOS are the biggest threats to your Mac (Moonlock)](https://moonlock.com/macsync-amos-stealer-biggest-threats)
- [North Korea Uses ClickFix to Target macOS Users' Data (Dark Reading)](https://www.darkreading.com/application-security/north-korea-clickfix-target-macos-users-data)
- [North Korean hackers targeted crypto exec with ClickFix (The Record)](https://therecord.media/north-korean-hackers-targeted-crypto-exec-clickfix)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4904