ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers

This article covers three ClickFix campaigns that distributed the MacSync macOS infostealer by impersonating AI tool installers and exploiting user trust in platforms like ChatGPT.

• •Three campaigns ran from November 2025 to February 2026, luring users via fake OpenAI Atlas browser downloads, malicious ChatGPT conversation redirects, and ClickFix lures targeting Belgium, India, and the Americas
• •The latest MacSync variant uses dynamic AppleScript payloads and in-memory execution to evade static analysis and bypass behavioral detection
• •A related tactic called InstallFix abuses legitimate platforms (Cloudflare Pages, Squarespace) hosting fake Claude Code install instructions that deploy Alien Stealer on Windows and Atomic Stealer on macOS
• •At least 20 distinct malware campaigns targeted AI and vibe coding tools between February and March 2026, heavily skewing toward macOS due to higher-value credentials like SSH keys and crypto wallets