---
id: 6197
title: "Fake Homebrew Pages Deliver Cuckoo Stealer via ClickFix | macOS Threat Hunting Analysis"
source_domain: hunt.io
source_url: "https://hunt.io/blog/fake-homebrew-clickfix-cuckoo-stealer-macos"
published_at: "2026-02-17T00:00:00Z"
tags: ["supply-chain", "malware", "threat-hunting", "macos", "typosquatting", "homebrew", "cuckoo-stealer", "clickfix", "info-stealer"]
phying_url: "https://phying.com/item/6197"
lang: en
---

# Fake Homebrew Pages Deliver Cuckoo Stealer via ClickFix | macOS Threat Hunting Analysis

## Summary

Homebrew typosquats delivered Cuckoo Stealer via ClickFix: a first stage stole credentials via dscl authonly prompts, then a macOS infostealer/RAT hitting 20+ wallets and persisting via LaunchAgent.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2026-02-17T00:00:00Z
- **Original:** https://hunt.io/blog/fake-homebrew-clickfix-cuckoo-stealer-macos
- **Phying News:** https://phying.com/item/6197