ANY.RUN attributes an active ClickFix-style macOS campaign to Lazarus Group, with fake meeting lures delivered through Telegram and impersonated Zoom, Teams, or Google Meet pages. Victims are instructed to run terminal commands that install the Go-based Mach-O Man Mach-O malware kit, starting with a stager that downloads fake macOS applications and follow-on binaries. The chain profiles the host, targets browsers including Brave, Vivaldi, Opera, Chrome, Firefox, and Safari, establishes persistence through a LaunchAgent under an “Antivirus Service” folder, and stages credentials, cookies, browser extension data, macOS Keychain entries, and other files for theft. Telegram is also described as an exfiltration channel, making the campaign especially relevant to fintech, crypto, and other high-value macOS-heavy environments where a single compromised developer or executive device can expose infrastructure and financial assets.