macOS ClickFix: fake verification page staging a disguised Terminal command — page code

Fake verification pages ('I'm not a robot', 'Manual verification', 'Verify you are human') that copy a shell command to the visitor's clipboard and tell Mac users to open Terminal with Command+Space, paste with Command+V and press Return. The pasted command downloads and runs a script, usually disguised: base64 decoded straight into a shell (for example bash <<< $(echo "…" | base64 -d)), or a download from a throwaway tunnel address piped into sh. Seen on Cloudflare Pages sites such as securecheckv1-proceed[.]pages[.]dev and quicksecurity-checkpointv1[.]pages[.]dev (since at least September 2026), whose payload hosts virelianmatrix[.]digital and aetherframework[.]digital are publicly labelled ClearFake; in a multi-platform ClickFix overlay injected into compromised websites, whose macOS branch fetches from escapeai[.]live (publicly labelled AMOS); and in a document-signing lure described in a September 2026 report on the AvisLoader malware. No legitimate verification step asks visitors to run a command in Terminal.