ClickFix attacks infecting PCs and Macs are going viral

Attackers are using the ClickFix lure to drop the MacSync stealer and to masquerade as AI chat installers, aiming to capture user credentials and cryptocurrency wallets. The lures are distributed through shared AI chat links and appear as legitimate installers for popular large‑language‑model tools, exploiting users' trust in AI assistants. CyberPress.org details how the MacSync stealer exploits ClickFix lures, while B2B Cyber Security notes that shared AI chats are a vector for the malware. gbhackers.com highlights bypasses of macOS security, and CyberSecurityNews reports fake Claude and ChatGPT installers being used on Macs.

The MacSync stealer is reported to exfiltrate saved passwords and cryptocurrency wallet files, while the counterfeit Claude and ChatGPT installers are packaged to look like official binaries. Ars Technica calls the campaign viral. Both Windows and macOS users who download AI tools are now exposed, prompting security teams to monitor for credential theft.

The reports do not yet detail specific mitigation steps, so observers will watch for additional variants or distribution methods in upcoming coverage. Industry watchers anticipate that antivirus vendors will roll out updated signatures, and security teams are advised to educate users about the look‑alike installers.