Leadership1 distinct publisher2 min readPublished
Microsoft says the campaign now delivers its payload through a command pasted into Terminal rather than a .dmg installer. The review step that mattered was tied to that older delivery method, and the attackers no longer need it.
The Board Room · Leadership desk
Compiled by The Board RoomSomething wrong?How this is made
Gatekeeper's checks attach to an object. An application bundle opened through Finder can be evaluated for code signing and notarization, while a script fetched and launched inside a Terminal session is not that object [8]. Microsoft describes the loader path as a chain of ordinary tools: curl retrieves a shell script from attacker infrastructure once the user pastes the command, and a second-stage zsh loader Base64-decodes and Gzip-decompresses an embedded payload before running it through eval [15][16]. Nothing in that sequence is anomalous in isolation, which is why the detectable unit is the sequence rather than any single binary.
The staging paths show how cheap the attacker's side of this is. Microsoft reports the loader and helper campaigns writing to /tmp/shub_<random ID> or /tmp/<random ID>, where the ID is a random seven-digit value [14]. Seven decimal digits gives ten million possible folder names [19], so a blocklist built from one sample says almost nothing about the next one, and widening it to a prefix pattern costs the attacker a single line to change. Indicator lists here age faster than the tradecraft they describe.
This is not simply the familiar problem of a user running a command they do not understand. Two details in Microsoft's account point to something more specific. The victim arrives by intent, searching for a remedy to a real annoyance such as disk space, and finds the malicious command presented as that remedy [2], and some of the standalone pages carried the instruction in more than one language [10]. Awareness training built around unsolicited mail and unexpected prompts does not cover the case where the user went looking, which is the substance of Microsoft's assessment that this method reduces reliance on traditional application delivery and raises the likelihood of successful execution [9].
There is a limit to what the published record supports. The loader sends home a fingerprint of keyboard locale, hostname, operating system version and external IP, together with an event name that is either loader_requested or cis_blocked [17]. The second name invites a story about regional filtering, and the Microsoft write-up we have stops before explaining it, so targeting stays unknown. What is dated is the window: the loader campaign has been observed since February 2026, roughly three months before the May 6 publication [15][18][20]. The question in front of most Mac fleets this quarter is a narrow one, whether endpoint telemetry covers interpreter and network-utility behaviour at all, and the consequence for anyone answering no is that the first evidence of these campaigns arrives from the exfiltration end.
Ranked by verification strength, evidence, and original report placement.
Microsoft researchers report continued observation of an infostealer campaign distributing ClickFix-style instructions and targeting macOS users.
In this iteration, threat actors host malicious commands on blog sites and user-driven content platforms, targeting users looking for helpful advice on macOS issues such as optimizing disk space.
The commands purport to install system utilities but instead load infostealing malware such as Macsync, Shub Stealer and AMOS.
The malware collects and exfiltrates data including media files, iCloud data, Keychain entries and cryptocurrency wallet keys.
In some campaigns the malware replaces legitimate cryptocurrency wallet apps with trojanized versions.
Prior iterations of the campaign delivered the infostealers through disk image (.dmg) files that required users to manually install an application.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 31, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
build
AmnesiaStealer drives your own browser, so session theft is the real macOS loss1 distinct publisher
product
Fake Codex installer outranks OpenAI in Google ads, then asks for a paste1 distinct publisher
leadership
ClickFix scales by asking employees to paste the command themselves1 distinct publisher
leadership
TerminalFix sends the fake CAPTCHA command to PowerShell so multi-line payloads survive1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Specific, first-hand, unchecked
The technical spine is concrete enough to test against your own logs tonight: curl to a zsh loader, Base64 and Gzip into eval, /tmp/shub_ plus seven digits, a JSON beacon carrying loader_requested or cis_blocked. That comes from the telemetry of the company that ships the endpoint agent, which is the strongest and the weakest thing about it — no second researcher, no word from Apple, and the copy we hold breaks off mid-section, before the detection table it advertises.
Running operation, unsized
Three execution paths on separate infrastructure, lures placed on standalone sites, Craft and Medium, and a loader tracked since February — this is an operation being maintained, not a proof of concept. But not a single number describes its reach: no victims, no infections, no share of any Mac fleet. The most quantitative fact offered is how fast the pages came down.
A half-step ahead of the numbers
Microsoft's prose is dry and its claims are mostly narrow, which is why the one unmeasured sentence stands out: that user-invoked commands increase the likelihood of successful execution. Plausible, untested, and the closest thing here to a pitch. Set against that, nobody claims a victim count they cannot show, and the Gatekeeper point is stated as scope, not as a broken lock.
The mapmaker sells the map
The party describing where macOS verification does not reach is also the party selling the agent that would catch what gets through, and the post says up front that it ends in detection and mitigation guidance. That does not make the forensics wrong — it does mean the taxonomy, the campaign names and the assessment of effectiveness are all authored by an interested vendor, including a malware name lifted from a string the sample writes into /tmp.
Credible until someone else looks
Detailed first-party forensics, uncontradicted and uncorroborated, is a fair basis for acting on the indicators and a thin one for stating how big the problem is. Add the calendar: this was written on May 6 and reached us at the end of August, ample time for the hosts, the staging names and the beacon strings to have moved on.