tryclix.com: a Mac ClickFix site listed for the MacSync stealer, and what to do if you pasted its command

What tryclix.com is, and what we know about it

tryclix.com is known to us only through three malware addresses that a URLhaus reporter added on 26 September 2026. We never saw the page that visitors see, so this guide says plainly which parts are reports and which parts are our own checks.

1. 1

   What URLhaus lists

   Three addresses on tryclix.com, all added on 26 September 2026 at about 06:23 UTC by the reporter c4ffeine. One sits under /curl/, one is /dynamic with a txd value, and one sits under /loader/agent/. Each ends in the same 64 character token, which starts with b54cc90c. All three are marked malware_download and all three were offline when we read them.

2. 2

   What the tags mean

   ClickFix is a trick in which a fake page makes you copy a command and run it yourself. MacSync is the name of a Mac information stealer. zsh is the shell that Terminal uses on a modern Mac, AppleScript is the Mac scripting language, and Mach-O is the program format of macOS. Together the tags describe a pasted command that pulls a script, a second script and a program.

3. 3

   What we could not confirm

   We did not download any file and we never saw the page that tells visitors what to paste. So we do not know the lure, what the scripts do, or whether the three files really belong to MacSync. The labels are the reporter's, not our own findings.

4. 4

   What this means for you

   If you only saw the name in a log, a link or a warning, that alone did not infect you. The risk is for people who pasted a command from the site into Terminal, or who opened a file from it.

Kind of threat

A malware download address for Macs, tagged ClickFix and MacSync

Delivery trick

ClickFix: a fake page asks you to copy a command and paste it into Terminal

Domain registered

4 March 2025, expires 4 March 2027, registrar Unstoppable Domains Inc.; record last changed 26 September 2026 (RDAP, read 10 October 2026)

URLhaus entries

3 file addresses, all added on 26 September 2026, all offline when we read them

Platform

macOS, by the macOS, zsh, AppleScript and Mach-O tags

What we checked on 10 October 2026, and what we could not

We tried to open https://tryclix.com/ once, from Lithuania, in an automated Chromium browser set to English. The browser could not find the domain. That tells you nothing good about the site, and it clears nothing.

What happened to tryclix.com, from registration to our test

This domain is not new. It was registered in March 2025, more than a year before the reports, so a young domain is not the warning sign here. The dates come from RDAP and from the URLhaus database.

1. 4 March 2025

   The domain is registered

   RDAP shows tryclix.com registered on 4 March 2025 through Unstoppable Domains Inc., valid until 4 March 2027. We found nothing that shows a real business behind the name, and we do not know who held the domain in 2025.

2. 26 September 2026

   Three files are reported in one batch

   At about 06:23 UTC the reporter c4ffeine adds three addresses to URLhaus, with the tags ClickFix, macOS and MacSync. The same day RDAP shows the domain record changed. We do not know whether the two events are connected.

3. 10 October 2026

   Our test finds no address for the name

   Our single visit fails with a name resolution error. When we read the database all three addresses are marked offline.

Two weeks passed between the reports and our test. A domain that stopped answering inside that window may have been taken down, or it may have been left behind by the operators on purpose. A name that no longer answers does not remove the risk for a Mac that already ran the command.

How the ClickFix trick works on a Mac

ClickFix does not use a security hole. It makes you do the infecting yourself, so the checks that Apple builds into downloads may never get a say. We did not see tryclix.com's page; this is how Moonlock and the Center for Internet Security describe MacSync campaigns.

1. 1

   You land on a page with a reason to open Terminal

   Moonlock describes a fake Cloudflare Turnstile check that tells you to copy a command. The Center for Internet Security describes a fake CAPTCHA reached from a search result for a free e-book. The reason differs; the goal is the same.

2. 2

   The page copies a command for you

   In the CIS case the pasted line was Base64 text. Decoded, it printed the message Installing package please wait while it quietly ran a curl command. In Moonlock's case the pasted text was an obfuscated AppleScript that ran in the background.

3. 3

   You open Terminal and paste

   The page tells you to open Terminal, press Command + V and press Return. Terminal runs the line with your rights. Nothing was opened through Finder, so the first open check described below never has the chance to act.

4. 4

   A script fetches the next stage

   CIS describes a zsh script fetched by curl with a 64 character token in the address. The token ties the download to one visitor and helps the operators block analysis machines. This matches the long token that ends all three tryclix.com addresses.

5. 5

   An AppleScript asks for your password and collects files

   CIS saw the AppleScript run in memory through osascript, close Terminal, show a fake window called Required Application Helper that asks for the Mac password with no cancel button, and pack the data into a zip file in /tmp.

Apple says Gatekeeper is designed to help ensure that only trusted software runs on a Mac, and that it asks for approval before downloaded software opens for the first time. Apple's page does not say how this applies to a command you paste yourself, so we do not claim that it would have stopped this.

The three addresses: what each suggests, and what we do not know

Paths and tags are weak evidence. We list what each address could be and mark which statements are only a reading.

The same token in all three addresses says they were made for one visitor session, or at least for one build of the chain. It does not say how many people received them. URLhaus does not show a victim count and neither do we.

What MacSync is and what a Mac stealer takes

We do not know that the programs on this server are MacSync, only that a reporter tagged them so. Here is what Moonlock and the Center for Internet Security publish about MacSync infections, as a guide to what may be at stake.

What this can cost you

Reading the site name or seeing a warning costs nothing. The risks below apply to a Mac where the command was pasted and run, or a file from the site was opened.

• High

  Account takeover

  A stealer takes saved logins and browser sessions, which let someone use your email, social and work accounts. Changing a password alone may not end a stolen session.

• High

  Crypto theft

  Wallet files and wallet apps are a main target. Stolen crypto cannot be reversed, so move funds from a clean device before you do anything else on the Mac.

• High

  A replaced wallet app

  If you use Ledger Live on that Mac, CIS says the app can be swapped for a copy that steals the seed phrase each time it opens. Treat that wallet as exposed.

• High

  Developer and cloud keys

  SSH keys, AWS credentials and shell history were taken in the published case. A key found there can be used to read data or run services on your bill.

• Medium

  A backdoor that takes orders

  The reporter tagged one file as a backdoor. If it ran, someone may be able to send commands to the Mac until it is erased.

• Medium

  Work accounts and company data

  On a work Mac the passwords and sessions in the browser reach company systems. Tell your IT or security team at once; they can block the accounts.

• Low

  Nothing, if you only saw the name

  A name in a warning, a firewall log or a blocked link is not an infection.

What you may notice, and what you may not

Most victims notice nothing. The signs below follow from how these chains work; the first two are the best evidence you have.

How people end up on a page like this

We do not know how visitors reached tryclix.com. These are the routes that the sources we read describe for MacSync and ClickFix pages in general.

1. 1

   A search result for something free

   CIS describes a poisoned search result for a free e-book that led to a fake CAPTCHA. Searches for cracked software and free tools lead to the same kind of page.

2. 2

   A fake Download for macOS button

   Moonlock describes a page whose download button does not download a file. It shows instructions that end with a command to paste.

3. 3

   A fake verification step

   A page claims that you must prove you are human by pasting something. A real check such as Cloudflare Turnstile never asks you to open Terminal.

4. 4

   A link you were sent

   A message, an ad or a hacked website can point to the page. The page can look different for each visitor, which is one more reason our single test proves little.

Check your Mac before you delete anything

These checks help you decide whether the command ran. They are not a way to prove that a Mac is clean. If you pasted the command, go to the next chapters whatever you find.

1. 1

   Read the Terminal history

   Open Terminal and type history, then press Return. Look for a long line with curl, a web address, base64, zsh or osascript that you did not write. You can also open the file .zsh_history in your home folder. The history may be cut if Terminal was closed in an unusual way.

2. 2

   Look at Login Items

   On macOS Ventura and later, open System Settings, choose General, then Login Items & Extensions. Read both the list that opens at login and the list that runs in the background. Remove nothing yet; write down what looks unknown.

3. 3

   Look in the LaunchAgents folders

   In Finder choose Go, then Go to Folder, and open ~/Library/LaunchAgents, then /Library/LaunchAgents and /Library/LaunchDaemons. Files with names that you do not know, or that pretend to be Apple, deserve a closer look.

4. 4

   Look in /tmp for staging folders

   CIS names a staging folder that starts with sync followed by seven digits, and a zip called osalogging. Moonlock names a zip called salmonela. The stealers delete their files after the upload, so an empty /tmp proves little.

5. 5

   Remember what a clean check means

   Finding nothing means only that these places were quiet. Stealers delete their traces and a backdoor may sit somewhere else. If you pasted the command, erase the Mac.

What a scan can and cannot do on a Mac

A scanner can add information. It cannot give you a reason to skip the steps that protect your accounts.

1. 1

   Update macOS first

   Open System Settings, General, Software Update and install what is offered. Apple updates its built in malware checks with the system. Do this on a Mac that you will keep using, and do it after you change passwords from another device.

2. 2

   Check what is allowed to read your files

   In System Settings choose Privacy & Security, then Full Disk Access, Accessibility and Automation. Remove entries for apps that you do not know. Terminal needs none of these for normal use unless you gave them yourself.

3. 3

   Run a scanner that reads the Mac

   A Mac security scanner can look for known samples and for files in the places above. A result of nothing found does not clear a Mac that ran a stealer, since the files may already be deleted and the damage is the data that left.

4. 4

   Do not stop there

   The loss happens in the first minutes. After a scan, continue with passwords, sessions, keys and the erase.

If you use Windows, an iPhone or an Android phone

The three addresses are tagged for macOS only. A Mac command does not work on other systems, but your accounts may be shared across them.