OPEN LINK ↗
// 4h agoSECURITY INCIDENT
ClickFix malware hits Kash Patel apparel site
Kash Patel's merchandise website was compromised to distribute "ClickFix" malware targeting macOS users. Visitors were presented with a fake Cloudflare CAPTCHA that tricked them into pasting a malicious command into their Terminal, executing an infostealer.
// ANALYSIS
The ClickFix attack vector highlights how social engineering can bypass browser sandboxes by weaponizing the clipboard and user trust in security checkpoints.
- –The fake CAPTCHA instructs users to copy a "Verification ID," but the button places a hidden, obfuscated shell script on the clipboard
- –When executed in the macOS Terminal, the payload silently extracts cryptocurrency wallets, browser session tokens, and Keychain credentials
- –This technique relies entirely on user interaction, making it effective against developers and power users accustomed to command-line tools
- –Apple has introduced warnings in macOS Tahoe 26.4 to flag commands pasted directly from web browsers into the Terminal
// TAGS
securitycliclickfixmacosbased-apparelcloudflare
DISCOVERED
4h ago
2026-05-23
PUBLISHED
8h ago
2026-05-23
RELEVANCE
5/ 10
AUTHOR
bilalq
