ClickFix Tops Malware Delivery Charts, and macOS Is in Scope

There's a particular flavour of attack that works because it convinces the victim to do the work themselves. It's called ClickFix, and a fresh ReliaQuest report covering March to May 2026 puts it at the top of the chart: the single most popular way criminals are getting malware onto machines right now.

The setup is almost insultingly simple. A compromised or malicious site throws up a fake CAPTCHA, or an equally innocuous-looking prompt about a broken page or a verification step, and asks the user to paste a command into a system dialog. The user pastes. PowerShell runs. An infostealer lands. Because the command was typed in by a real human using a trusted built-in tool, most endpoint defences see nothing worth blocking.

Now hitting macOS too

During the reporting window, ClickFix was used to drop Deepload on Windows and, for the first time, Atomic Stealer (AMOS) on macOS. AMOS is the one Mac users should worry about. It targets browser credentials, session cookies, crypto wallets and keychain data, which is roughly the entire contents of someone's digital life.

The interesting wrinkle is how the macOS variant is delivered. Apple recently added a feature that scans commands pasted into Terminal and warns when something looks suspicious. The attackers shrugged and switched lures, walking victims through Apple's Script Editor instead. Same outcome, different app, no warning.

The "Macs are safer" myth, gently retired

ReliaQuest's message to enterprises is blunt: macOS can no longer be the unmonitored corner of the estate. It needs the same telemetry, the same detection rules and the same scrutiny as Windows. The technical mitigations are well understood:

• Restrict the Run dialog on Windows where the business case allows.
• Block clipboard-to-execution patterns through endpoint policy.
• Filter the malvertising networks that route users to these pages in the first place.
• Bring macOS endpoints into the same EDR coverage as Windows ones.

All of which helps. None of which matters once a person is halfway through pasting a command they've been told will verify their humanity. The reason ClickFix works is not technical sophistication, it's social engineering wrapped in a CAPTCHA. The attacker never has to defeat the operating system because the user has already been convinced to do it for them.

That's the part worth sitting with. The defenders' tooling has genuinely improved over the last few years. Scripts get sandboxed, downloads get inspected, suspicious binaries get quarantined. So the attackers stopped trying to smuggle code past the gate and started handing it to people to carry through themselves. It's a clever pivot, and it's working well enough that ClickFix is now the dominant delivery method across both major desktop platforms.

The fix, such as it is, lives in two places: the controls that make pasting a hostile command harder, and the instinct that stops someone doing it in the first place. Both need investment. Neither is optional anymore, regardless of which logo is on the laptop.