ISC Flags "Macfinger" ClickFix Campaign Targeting Users via Fake Verification Prompts

What Happened

The SANS Internet Storm Center (ISC) published a diary on September 22, 2026 describing a campaign it labels "Macfinger," categorized under the ClickFix tactic. ClickFix attacks typically present a victim with a fake error, CAPTCHA, or verification prompt that instructs them to manually copy and run a malicious command (often via a "Run" dialog or terminal) to "fix" or "verify" something. The ISC diary entry currently available is limited to an introduction, so full technical details — payload behavior, delivery vector, and targeting scope — have not yet been disclosed in the summarized content.

Why It Matters

ClickFix-style campaigns have grown into one of the more effective social-engineering vectors because they rely on the user themselves executing the malicious command, which can bypass some automated download and execution controls. A campaign specifically branded or tracked as "Macfinger" suggests defenders should watch for macOS-focused or fingerprinting-related tradecraft, though ISC has not yet detailed the exact platforms or lures involved. Any organization where users browse the web and could be presented with fake system prompts is potentially exposed.

What Defenders Should Do Now

• Review user-execution and clipboard-to-terminal/run-dialog activity in EDR telemetry, particularly instances where a browser session precedes a paste into a shell, PowerShell, or macOS Terminal/Script Editor.
• Hunt for anomalous execution of scripting interpreters (bash, zsh, osascript, PowerShell, cmd) immediately following browser activity, especially from non-standard parent processes.
• Reinforce user awareness that legitimate verification or CAPTCHA prompts never ask a user to manually run commands.
• Monitor DNS and proxy logs for newly registered or suspicious domains serving fake verification pages, and flag pages that attempt to auto-copy text to the clipboard.

Developing Intel

This is net-new intelligence and the full ISC diary content was not yet available at the time of this write-up beyond an introductory summary. Defenders should monitor the original source for technical indicators and updates as they are published: SANS ISC diary #33360.