Has anyone been able to successfully replicate copying and pasting ClickFix/TerminalFix/*Fix commands into macOS Terminal to trigger this new-fangled malware warning? I have attempted numerous commands, from base64-encoded content to osascripts mimicking macOS infostealer prompts to cURL commands downloading remote content. I even replicated the command documented in the Toms Guide article using the same tool in the same browser and it ran flawlessly in Terminal with no popup. And yes, I’m running Tahoe 26.4 on an M3. I’d like to think this would be a useful ‘stop-and-think’ mitigation but I can’t even consistently trigger it. And, per usual, Apple is tight-lipped on HOW they are detecting malicious commands so it’s likely to remain a black box mitigation. And yeah, I get it, the end user can just click right through the warning via a sneaky social engineering prompt. My goal was to try and build out detection logic to ID when a user gets hit with a prompt so I can at least investigate what the user tried to do and dig deeper into the threat. Since theoretically the user won’t run the command, it won’t get logged in SIEM/EDR tools. I need to rely on other mechanisms for detecting the paste event.

https://www.tomsguide.com/computing/online-security/i-tried-apples-new-security-feature-in-macos-that-warns-you-about-potential-clickfix-attacks-and-windows-should-take-note?utm_source=flipboard&utm_medium=activitypub

#macos #clickfix #terminalfix #threatintel #pastejacking #detectionengineering #threathunting

Your org should be activating Entra ID conditional access policies to outright block device code authorizations with a carveout for very limited use cases such as meeting room conferencing devices. Even Microsoft knows this and has specific guidance on how to enforce it. Device code phishing is hot right now and these device code phishing-as-a-service platforms will likely lower the barrier of entry.

https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/

https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows

#phishing #eviltokens #soc #dfir #threathunting #cti #threatintel