New macOS ClickFix attack silently mounts DMGs to push infostealer
2026-06-23T19:23:27Z•5952f79c92b72424ba55ef93a0357173c19990829144328e26cbb3efc0117712
AryStingerClickFixD-LinkDMGFFmpegFortiBleedFortiGateFortinetPixelSmashPrinz EugenRCEVBScriptWhatsAppbotnetcredential-theftcredentialsdenial-of-serviceinfostealermacOSmalwarephishingransomwareremote code executionrouterssupply chain attack','Mastra AI','Sapphire Sleet','BlueNoroff','
What happened
Multiple high-impact threats and incidents reported: a macOS ClickFix campaign silently downloads, mounts DMGs and installs an info-stealer; FFmpeg patch fixes the 'PixelSmash' flaw that can lead to RCE/DoS in popular media servers and apps; FortiGate devices were targeted by a FortiBleed campaign using custom sniffers to harvest credentials; a new AryStinger botnet has infected thousands of D-Link routers; a Prinz Eugen ransomware family prioritizes recent files and leaves no ransom note; Microsoft links the Mastra AI supply-chain compromise to North Korean actor Sapphire Sleet (BlueNoroff) —
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 5952f79c92b72424ba55ef93a0357173c19990829144328e26cbb3efc0117712
- Enrichment time
- 2026-06-23T19:23:27Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.