Fake CAPTCHA Campaign Tricks Mac Users into Installing Backdoor for Data Theft and Crypto Mining
A new ClickFix campaign is targeting macOS users with a deceptive CAPTCHA page that prompts them to execute malicious commands, leading to backdoor installation, credential theft, and cryptocurrency mining.
Mac users are falling victim to a sophisticated ClickFix campaign that weaponizes the common CAPTCHA verification process to deliver a potent backdoor. Instead of downloading a file, users are tricked into running malicious commands directly in their Terminal application. The campaign employs a fake "TrustKey" human verification page, presenting an "I'm not a robot" checkbox. Upon interaction, a command is silently copied, and the user is instructed to paste it into their Terminal. This technique bypasses macOS's Gatekeeper security measures, as it doesn't involve a downloaded executable file.
Researchers at NetbyteSEC investigated this macOS lure in July 2026 and detailed how the initial command fetches an encoded AppleScript payload from a Cloudflare Worker. This script then establishes persistence by creating a LaunchAgent, ensuring the malware runs on subsequent logins. Crucially, the malware queries a Polygon smart contract to dynamically retrieve the address of its command and control (C2) server, a technique known as EtherHiding. This blockchain-based approach makes the C2 infrastructure highly fluid and difficult for defenders to block by relying on fixed domains.
The infection chain continues with the deployment of a backdoor that identifies the compromised device and user. It periodically checks in with the C2 server for new instructions. A particularly insidious feature is the presentation of a counterfeit macOS System Preferences prompt, designed to trick users into revealing their Mac login password. Once obtained, this cleartext credential is stored locally for later exfiltration.
Beyond credential theft, the backdoor can download and execute modules like Atomic macOS Stealer (AMOS). The full AMOS module is capable of harvesting sensitive data from browser profiles, including saved passwords, cookies, and wallet extension data. It also targets macOS login keychains, Telegram data, Safari information, and files within common user directories. The collected data is packaged and uploaded to attacker-controlled infrastructure.
Adding to the malicious payload, the campaign installs XMRig, a legitimate cryptocurrency mining program that is abused to mine Monero for the attackers. This process can lead to sustained high CPU usage, causing performance degradation, battery drain, and overheating on affected Macs. Removing only the mining component is insufficient, as the persistent backdoor agent can simply re-download and reinstall it.
Security experts advise users to treat any CAPTCHA that requests the execution of commands in Terminal as highly suspicious. Genuine verification processes do not require such actions. The safest response is to close the page immediately. Organizations are urged to hunt for unusual Terminal-launched AppleScript activity, unexpected LaunchAgents, and suspicious Polygon RPC requests. Individuals who may have fallen victim should disconnect their Mac from the network, change passwords from a trusted device, and seek professional assistance for system cleanup.
The campaign's reliance on social engineering, bypassing standard security checks, and employing dynamic C2 infrastructure highlights the evolving threat landscape for macOS users. The combination of credential theft, data exfiltration, and resource hijacking for cryptocurrency mining presents a multi-faceted threat that demands heightened user awareness and robust endpoint security measures.