ClickFix attacks infecting PCs and Macs are going viral

The campaigns use shared AI chat prompts that masquerade as legitimate Claude or ChatGPT installers, tricking users into running malicious code. Once executed, the payload delivers the MacSync stealer, which is designed to harvest login credentials and cryptocurrency wallet information from macOS devices. Coverage of the wave appears across six outlets. KELA Cyber Threat Intelligence outlines how macOS infostealers target Apple devices, while B2B Cyber Security points to the role of shared AI chats in spreading the malware. cyberpress.org and gbhackers.com detail the use of ClickFix lures to deploy the MacSync stealer and to bypass macOS security mechanisms. cybersecuritynews.com focuses on the fake Claude and ChatGPT installers as infection vectors, and Ars Technica notes the viral nature of the attacks on both PCs and Macs.

The reports place ClickFix within a broader trend of AI‑generated lures that exploit user trust in conversational assistants. MacSync, identified as a credential‑stealing stealer, aligns with recent macOS infostealer activity that seeks to extract sensitive data, including cryptocurrency keys. The ability to bypass built‑in macOS security, as highlighted by gbhackers.com, underscores a growing sophistication in cross‑platform malware that leverages social engineering through popular AI tools. Analysts advise monitoring for additional ClickFix‑related campaigns, especially those that may adopt new AI chat disguises or target other operating systems.

Security firms are likely to issue detection signatures for the MacSync payload, and updates from Apple’s security team may address the bypass techniques described. Observers should watch future coverage from the same outlets for guidance on remediation steps and any emerging variants, and anticipate patches from Apple and advisories from cybersecurity vendors.