macOS ClickFix: 'Secure Gateway • Quick Verification' kit — page title

Fake verification pages ('I'm not a robot', 'Manual verification', 'Verify you are human') that copy a shell command to the visitor's clipboard and tell Mac users to open Terminal with Command+Space, paste with Command+V and press Return. The pasted command downloads and runs a script, usually disguised: base64 decoded straight into a shell (for example bash <<< $(echo "…" | base64 -d)), or a download from a throwaway tunnel address piped into sh. Seen on Cloudflare Pages sites such as securecheckv1-proceed[.]pages[.]dev and quicksecurity-checkpointv1[.]pages[.]dev (since at least September 2026), whose payload hosts virelianmatrix[.]digital and aetherframework[.]digital are publicly labelled ClearFake; in a multi-platform ClickFix overlay injected into compromised websites, whose macOS branch fetches from escapeai[.]live (publicly labelled AMOS); and in a document-signing lure described in a September 2026 report on the AvisLoader malware. The script served to visitors of that Cloudflare Pages kit installs the Phexia macOS stealer, which stays running through a LaunchAgent and reads its command-and-control address from a smart contract on the Polygon blockchain, so the operator can move it to a new domain without changing the lure. No legitimate verification step asks visitors to run a command in Terminal.