Microsoft Security Team Uncovers Malicious macOS Guides Targeting Crypto Wallets

Microsoft's security research team has identified a cyberattack strategy that has been in operation since late 2025, according to PANews. The attackers have been publishing fake macOS troubleshooting guides on platforms such as Medium, Craft, and Squarespace. These guides, which address common user issues like freeing up disk space or fixing system errors, trick users into running malicious terminal commands. Once executed, these commands automatically download and run malware designed to steal cryptocurrency wallets, iCloud data, and passwords saved in browsers. This social engineering technique, known as ClickFix, bypasses macOS's Gatekeeper security mechanism because the victims voluntarily execute the commands.