UNC1069 macOS ClickFix Profiling Commands

Tim Peck@timpeck

•updated Feb 10, 2026•6•0•120

Detects a sequence of macOS system profiling and software update commands associated with the UNC1069 'ClickFix' social engineering ruse, often followed by a payload download via curl piped to a shell.