Why ClickFix is now the #1 way Macs get infected

9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple. In this episode of Security Bite, I sit down with macOS reverse engineer Christopher Lopez (@L0Psec) and returning guest Kseniia Yamburkh (@osint_barbie) of MacPaw's Moonlock Lab to unpack ClickFix, the social engineering technique behind nearly half of all reported breaches in 2025. We get into who's actually falling victim, why it exploded so fast, how Mac malware is evolving in 2026, the current landscape, and more. Links Notorious hacker return with notnullOSX, report from Moonlock Lab Submit a suspicious file to MacPaw for analysis Jamf's full Security 360 report covering 2025 landscape Follow Chris on X and YouTube Follow Kseniia on X Read more in the weekly Security Bite column Follow Arin on X and LinkedIn Subscribe to the show Apple Podcasts Spotify Overcast Pocket Casts RSS Feed