Back Gbhackers

Verified X Sponsored Ad Spreads Mac Malware While ConsentFix Hijacks Microsoft 365 Accounts

Gbhackers •Mayura Kathir • July 4, 2026

A Mac-targeting ClickFix campaign amplified through a verified X ad, and a novel browser-based hijack technique called ConsentFix that exfiltrates Microsoft 365 session tokens without traditional malware. Researchers at Jamf and Malwarebytes tracked the X incident where a verified account ran a promoting a macOS utility dubbed “DynamicLake” a lookalike for legitimate […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malware Spreads via Verified Ads on X Targeting Mac Users A ClickFix-style malware campaign was detected spreading through a sponsored ad on X, originating from a verified account. The ad masqueraded as the legitimate Mac app DynamicLake, leading users to a malicious domain, dynamicmacisland[.]com. Victims were instructed to execute Terminal commands to install malware, identified as a variant of Atomic Stealer, tracked as MacSync. The incident highlights vulnerabilities in X's ad approval process, allowing malware to bypass automated scans. The developer of DynamicLake expressed concern over the misuse of their brand and urged users to download only from their official site. Jamf Threat Labs and Malwarebytes are investigating the incident, marking it as a significant security breach for Mac users. This is the first known case of malware spread through ads on X, raising alarms about the platform's ad vetting procedures. 3 sources 65

Extracted Entities

Verified X Sponsored Ad Spreads Mac Malware While ConsentFix Hijacks Microsoft 365 Accounts

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (3)