ClickFix, Malicious DMGs Push notnullOSX to macOS Users

Gbhackers •Mayura Kathir • April 9, 2026

Hackers are abusing ClickFix commands and booby-trapping DMG installers to deliver a new macOS stealer called notnullOSX, built to loot high-value crypto wallets from Mac users. The story starts with 0xFFF, a malware developer who abruptly quit a major Russian-speaking hacking forum in 2023 after claiming he was being investigated and accusing the forum of […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New notnullOSX Malware Targets High-Value Crypto Wallets on macOS The notnullOSX malware has emerged as a significant threat targeting cryptocurrency wallets with balances exceeding $10,000 in Taiwan, Vietnam, and Spain. This campaign, identified as ClickFix, was reported on March 30, 2026, and involves deceptive tactics using a fake Google Document and a compromised YouTube channel to distribute the malware. Users are tricked into executing commands in the macOS Terminal that download notnullOSX, which requires total disk access. The malware's most alarming feature is its ReplaceApp module, which substitutes legitimate Trezor or Ledger Live wallets with counterfeit versions to steal secret seed phrases in real-time. The malware's developer, known as 0xFFF or alh1mik, rejoined a hacking forum earlier this year after a three-year hiatus. The ongoing attacks raise concerns about the security of cryptocurrency assets among macOS users. 3 sources 67

Extracted Entities

ClickFix, Malicious DMGs Push notnullOSX to macOS Users

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)