macOS storage-cleaner ClickFix

Summary

Recorded Future's Insikt Group published this on 25 March 2026 as the fifth of five ClickFix clusters. From December 2025 its pages imitate macOS storage-cleaning help and tell the reader to open Terminal and run a command said to clear temporary files. The command is wrapped in hex and Base64 layers, or Base64 alone, and decodes to a silent curl that follows redirects to the payload and keeps running after the window closes. Insikt assesses with high confidence that the payload was MacSync. Its two C2 hosts, both behind Cloudflare, also appear in Microsoft's May 2026 account of a macOS utility-lure campaign, where Microsoft attributes that execution path to AMOS: the two vendors name different stealers for the same servers.

Overlap with other campaigns

We compared the 8 indicators in this record — covering 8 distinct registrable domains — against the 60 other published campaigns in this corpus.

• AMOS with a hidden boot backdoor

  2026-08-07

  2 of the 8 indicators in macOS storage-cleaner ClickFix also appear in this campaign.

  Shared registrable domains (2)

  • joeyapple[.]comdomain, shown defanged for safety: joeyapple dot com
  • octopox[.]comdomain, shown defanged for safety: octopox dot com

• QuickBooks-themed ClickFix to NetSupport

  2026-10-11

  No indicator is shared, but the two records use the same registrable domains.

  Shared registrable domain (1)

  • it[.]comdomain, shown defanged for safety: it dot com

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

Execution mechanisms

The only execution mechanism any published account describes for this campaign is Terminal paste (macOS) (T1059.004), which 12 of the 61 published campaigns in this corpus also record (20%).

Indicators

8 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.