Jamf Threat Labs, the company’s security research arm, recently shared details of a ClickFix-style attack it spotted running as a ad on the social media site X. Originating from a well-known verified account, it a malicious domain under the guise of a popular Mac app.
The ad in question was posing as DynamicLake , a legitimate Mac utility that turns your MacBook’s notch into an unofficial but fully working Dynamic Island.
But per Jamf’s investigation, the original link seen above redirects to dynamicmacisland[.]com, a malicious lookalike domain with no ties to the actual app.
Once there, visitors were instructed to open Terminal and paste installation code that would quietly install malware on the victim’s Mac. This is a classic technique that defines ClickFix social engineering attacks.
Legitimate apps, which are signed and notiorized by Apple, will never ask you to do this.
Jamf identified the payload as a recent Atomic Stealer variant, which it tracks as MacSync . There have also been cases of DigitStealer identified in this attack too.
The ad came from a verified account with a fairly large following, which makes this all the more interesting and more dangerous. I’ve chosen to keep the account name anonymous to protect the owner’s identity, because they didn’t set out to spread malware.
Trust is the basic foundation of any good social engineering attack too.
The account owner getting fooled is one thing. X approving the ad and pushing it out as a post is another.
This ran through X’s ad system, checks and all, and still reached users. The lookalike domain and single redirect were almost certainly there to help slip past any of X’s automated scans. And it worked…
This should give you déjà vu many times over. In recent years, we’ve seen Google Ads approve an exorbitant number of malicious domains that were at the top of Google . One case last year involved the in results that distributed malware to Mac users.
9to5Mac reached out to X for and didn’t immediately hear back.
While this is the first instance we’ve seen of malware through ads on X, the developer of the real DynamicLake has been fighting malicious clones for a while now.
The fakes have become so widespread that they reached out to 9to5Mac directly and asked to a statement in this piece:
I’m truly sorry to anyone who wanted to install DynamicLake but ended up downloading this malware instead. DynamicLake is simply an app that brings the Dynamic Island for Mac, and I never imagined someone would abuse the brand this way.
I’m working hard to fight these fake copies, but unfortunately new ones keep appearing every few months. I won’t give up protecting the project and the community.
If you need any help or aren’t sure whether you downloaded the legitimate app, feel free to reach out to me. Please make sure you download DynamicLake only from DynamicLake.com, where purchases are securely handled through Gumroad.
Thank you for your support, and again, I’m sorry for the inconvenience.
Jamf Threat Labs reported the ad to X and it was removed fairly quickly.
Is X doing enough to keep malicious ads off the platform, or is this an impossible battle to win? Let me know your thoughts in the .
Get more from Arin Waichulis in the 9to5Mac Security Bite weekly-column and bi-weekly podcast .
Check out 9to5Mac on YouTube for more Apple news:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
