ClickFix Abuses Legitimate Homebrew Workflow to Deploy Cuckoo Stealer on macOS for Credential Harvesting

A targeted social engineering campaign is compromising macOS developers using fraudulent Homebrew installation pages. This attack employs Cuckoo Stealer, a credential-harvesting malware.

The campaign uses the ClickFix technique to deceive users into executing harmful Terminal commands that mimic legitimate software installation scripts. Unlike traditional exploits, this operation manipulates user trust and familiar developer workflows.

Attackers have set up typosquatted domains that closely replicate the official Homebrew website. When developers access these fraudulent pages , they are presented with a seemingly standard installation command. However, the command uses raw.homabrews.org instead of the legitimate domain raw.githubusercontent.com, a subtle change that can be easily overlooked.

Upon execution, the script continuously prompts for passwords using macOS Directory Services, ensuring attackers acquire valid credentials before deploying the secondary payload.

Hunt.io analysts identified this campaign upon discovering the domain homabrews.org, registered on January 13, 2026.

Analysis of the infrastructure shows six interconnected domains on shared infrastructure at IP address 5.255.123.244, with certificates dating back to July 2025. These domains employ various typosquatting techniques to enhance their deception.

The attack unfolds in two phases. Initially, a script mimics a Homebrew installer while validating user credentials via the dscl authonly command. Incorrect passwords prompt a "Sorry, try again" message, imitating standard sudo behavior.

After capturing valid credentials, the script downloads a binary called brew_agent, which encodes the stolen password in Base64, granting access to protected resources.

Cuckoo Stealer persists through the macOS LaunchAgent system, disguising itself as com.homebrew.brewupdater.plist. It employs anti-analysis techniques, such as locale-based filtering and XOR-based string obfuscation, to evade detection.

The command-and-control infrastructure uses encrypted HTTPS communications with X25519 elliptic curve Diffie-Hellman key exchange for session encryption.

This malware functions as a comprehensive remote access trojan. It can execute shell commands, reboot systems, self-destruct, and perform controlled data exfiltration . It targets browser credentials, cryptocurrency wallets, macOS Keychain databases, Apple Notes, and messaging applications like Discord and Telegram.

Based on reporting by Cyber Security News.