Mac users are facing a new cybersecurity threat involving a fake CAPTCHA campaign. The scam tricks users into executing commands that lead to password theft, remote control access, and unauthorized cryptocurrency mining.
How the Fake CAPTCHA Operates
The scheme entices users to execute a command in their Terminal instead of downloading an application. Disguised as a TrustKey human verification page, it mimics an ‘I’m not a robot’ checkbox. When selected, it copies a command to the clipboard and instructs the user to paste it into Terminal, circumventing standard security checks.
According to a report by NetbyteSEC shared with Cyber Security News, the investigation into this macOS threat began in July 2026. The command retrieves and executes code from a Cloudflare Worker using AppleScript, avoiding the installation of any visible software.
Implications of the Attack
The deceptive campaign goes beyond stealing a single login. It installs a persistent agent that captures the Mac’s login password, siphons browser and wallet information, and can deploy XMRig for cryptojacking. This underscores the dangers of malicious CAPTCHA loaders.
The initial command connects to a Cloudflare Worker that delivers an encoded AppleScript. This script establishes a LaunchAgent, allowing the malware to persist through system restarts. Using a method called EtherHiding, it queries a Polygon smart contract to find its command server, making it difficult for defenders to block.
Protecting Against the Threat
The malware further deploys a backdoor that communicates with a server for new instructions. It presents a fake macOS System Preferences prompt to capture the user’s password, storing it locally for later misuse.
Users should treat any CAPTCHA requesting Terminal or command tool access as suspicious. Genuine verification processes do not require such actions. To stay safe, users should close such pages immediately. The ClickFix method exemplifies how these tactics can deliver diverse payloads.
Future Risks and Recommendations
The malware can download a full or lightweight version of the Atomic macOS Stealer (AMOS), targeting browser profiles, keychain data, and more. This highlights the ongoing risk to Mac users who may believe their systems are immune to such threats.
Organizations should monitor for unusual Terminal-launched AppleScript activity, unexpected LaunchAgents, and suspicious RPC requests. Individuals who have been affected should disconnect their networks, change passwords using a clean device, and conduct a thorough system examination to remove the persistent backdoor before resuming normal use.
