Anatomy of a macOS ClickFix Crimekit that Weaponises EtherHiding

Reported 24 Aug 2026 by otx · Severity: medium

A sophisticated macOS campaign exploits ClickFix social engineering, deceiving victims into executing malicious AppleScript commands via fake CAPTCHA verification pages. The attack chain deploys a persistent backdoor agent that utilizes EtherHiding, storing C2 addresses in Polygo