Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

PasteSwitch ClickFix malware delivery of MacSync, AMOS helper, and Amatera Stealer

Malware Activity
First reported
Last updated
Happening score
H score 30
1 unique sources, 2 articles

Summary

Hide ▲

PasteSwitch continues to use ClickFix-style social engineering to push MacSync and related payloads onto Windows and macOS systems, with a prior HBO Max Reddit account hijack used to run 108 malicious advertisements over about 48 hours. The campaign steers victims into pasting commands into trusted tools such as Windows Run, PowerShell, and macOS Terminal, and also promotes fake Ledger, Trezor Suite, and Exodus wallet apps. The newer MacSync activity adds public iCloud calendar events as a delivery channel on macOS, hiding commands in a calendar DESCRIPTION: field and fetching the next stage from iCloud. That MacSync variant also includes an Objective-C backdoor that masquerades as Finder, uses LaunchAgent, .zshrc modifications, and global Git hooks for persistence, and can run attacker-supplied AppleScript or replace an installed Ledger wallet app.

Related Happenings

MacSync macOS infostealer with iCloud calendar payload delivery

Malware Activity
H score29 First: 24.09.2026 23:53 Last: 24.09.2026 23:53 Sources 1

How related: A new variant of the MacSync info-stealing malware targeting macOS systems now uses public iCloud calendar events to deliver fresh payloads.

About this happening: MacSync now uses public iCloud calendar events to deliver fresh payloads on macOS, expanding its infection chain and increasing the risk of credential theft and re...

Open Happening

PasteSwitch malicious ClickFix ads campaign via HBO Max Reddit account

Campaign
H score32 First: 21.09.2026 11:39 Last: 21.09.2026 11:39 Sources 1

About this happening: The PasteSwitch campaign abused HBO Max's official Reddit account (u/hbomax) to push 108 malicious ads over 48 hours, turning a trusted brand channel into a delive...

Open Happening

AmnesiaStealer macOS infostealer distributed via ClickFix

Malware Activity
H score16 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: AmnesiaStealer is a Rust-based macOS infostealer spread through a counterfeit GitHub "Download for macOS" page and ClickFix-style lure. It steals Keychain, b...

Open Happening

ClickFix AmnesiaStealer distribution campaign targeting mac users

Campaign
H score22 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: A ClickFix campaign is distributing AmnesiaStealer to macOS users through a counterfeit GitHub "Download for macOS" page and a copy-and-paste command that launches...

Latest development: 16.08.2026 18:07

Jamf described AmnesiaStealer's stream_module and remote_stream commands, which copy a victim's Chromium profile into a hidden headless browser and open WebSocket and Chrome DevTools Protocol channels through webSocketDebuggerUrl. The operator can issue navigation and mouse commands, receive live screencasts, and export or import cookies to operate online portals inside the victim's authenticated sessions on Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium.

Open Happening

Go-based macOS stealer with DRAIN wallet-draining routine

Malware Activity
H score29 First: 07.08.2026 21:29 Last: 07.08.2026 21:29 Sources 1

About this happening: A Go-based macOS stealer delivered through ClickFix-style attacks is stealing browser passwords, Apple iCloud Keychain data, and cached credentials while also...

Open Happening

Timeline

  1. 24.09.2026 23:53 1 articles · 3d ago

    MacSync uses public iCloud calendar events to deliver payloads on macOS

    Campaign Scope Update

    Kaspersky identified a MacSync campaign targeting macOS that uses public iCloud calendar events to hide commands in the DESCRIPTION: line, fetch a next-stage archive from iCloud, and reach the malware through an APP bundle dropper. The same campaign also adds an Objective-C backdoor that disguises itself as Finder, establishes persistence through LaunchAgent, .zshrc modifications, and global Git hooks, and can run attacker-supplied AppleScript or replace an installed Ledger wallet app.

    Show sources
    Open in new tab
  2. 14.09.2026 21:34 2 articles · 13d ago

    HBO Max Reddit account hijack drives ClickFix malware ads

    Initial Disclosure

    Researchers said the verified u/hbomax Reddit account for HBO Max was hijacked and used to run 108 malicious advertisements over about 48 hours, steering users to fake HBO Max download pages and ClickFix prompts that told them to paste commands into Windows Run, PowerShell, or macOS Terminal. The broader PasteSwitch campaign delivered MacSync, AMOS helper, and Amatera Stealer, and also pushed fake Ledger, Trezor Suite, and Exodus wallet apps plus AnimateClipper and ZigClipper.

    Show sources
    Open in new tab