Platforms Enterprise It SecurityControl

ClickFix social engineering protections in Apple XProtect and macOS reverse engineering

March 30, 2026Patrick Wardle, Malwarebytes

Patrick Wardle says Apple added ClickFix protections to XProtect but kept key details private, so he reversed xprotectd to document behavior and enable others to build similar defenses.

Apple (copied BlockBlock 👀) and added ClickFix protections… but kept the good stuff private 😤
Reversed xprotectd to see how it really works and emerged with enough detail to build your own (kinda)!
ClickFix is a social engineering method that tricks users into infecting their own devices with malware.
Patrick Wardle
Malwarebytes
macosreverse engineeringsocial engineeringmacosreverse engineeringsocial engineering

See what experts are saying right now

This finding is one of many signals tracked across Cyber Security. The live feed updates every few hours with new expert voices, debates, and emerging ideas.

← Back to Cyber Security