Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.

Gbhackers •Mayura Kathir • September 10, 2026

Threat actors are increasingly using ClickFix social-engineering lures and -engine malvertising to deploy MacSync Stealer, a macOS-focused information stealer and remote-access staging framework sold through a malware-as-a-service model. The campaigns do not require a macOS vulnerability; instead, they abuse user trust by persuading victims to paste attacker-controlled commands into Terminal, sidestepping traditional file-centric protections. However, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

HBO Max Account Compromise Fuels ClickFix Malware Campaign In September 2026, hackers compromised the verified HBO Max Reddit account, launching a ClickFix campaign that distributed 108 malicious ads over 48 hours. The ads targeted both macOS and Windows users, tricking them into executing commands that installed information-stealing malware. This operation, dubbed PasteSwitch, utilized social engineering tactics to bypass security measures by convincing users to paste commands into their system terminals. The malware included infostealers, loaders, and cryptocurrency clippers, affecting user credentials and sensitive data. Security researchers from Hudson Rock and ADAMnetworks confirmed the scale and sophistication of the attack, which was paused after user reports prompted an investigation. The compromised account leveraged its trusted status to maximize the impact of the malicious ads. The incident highlights the growing threat of ClickFix attacks, which have become increasingly prevalent in 2026. 45 sources 70

Extracted Entities

Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)