GoKawiil9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIALtoday and understand why Mosyle is everything you need to work with Apple.
This is the first quarterly threat landscape review in the Security Bite series. And the first quarter of this year was pretty quiet on the iPhone front. When it comes to the walled fortress of iOS, no news is basically good news. So, in this Q1 review, I’m going to specifically be going over the Mac malware landscape and what it looks like, and where things seem to be heading.
I’ll look back on every report I covered, every guest I had on the Security Bite Podcast, and most of the samples that crossed my desk over the past three(ish) months.
There are three major takeaways from this Q1 review. The first one being that attackers have mostly stopped trying to break into Macs and are instead getting let in…
ClickFix, and Apple’s counterpunch that didn’t woo
Still dominating the landscape is ClickFix. And surprise, surprise: the first half of the year was largely centered around it. We saw new ClickFix attack methods, a new prevention feature from Apple, and I even hosted an entire hour-long podcast about it.
ClickFix stopped being a niche initial access method sometime in 2024. And as of this quarter, it’s now the unofficial default way to get malware onto a Mac.
It’s important to note that it’s not a malware family in and of itself, but a social engineering technique. A way to get malware payloads through. It works by showing you a fake error or verification step to resolve, handing a malicious command to paste into Terminal. Once you run it, the system treats it as a legitimate action, because technically it was.
Microsoft’s 2025 Digital Defense Report, which was released in Q1 this year, named it the most common initial access method of the year, at roughly 47% of reported attacks. Moonlock Lab, the security research arm of popular software firm MacPaw, also recently published a report finding that 66% of Mac users with its software installed encountered at least one threat in 2025, with ClickFix leading the pack.
So, ClickFix is a problem. But what is it doing exactly to lure people into infecting themselves?
... continue reading