Kash Patel’s ‘BasedApparel’ Website Apparently Hosts ClickFix Malware

• Researcher discovers Based Apparel site serving macOS ClickFix information stealer disguised as Cloudflare CAPTCHA control
• Victims were tricked into pasting malicious Applescript commands into the terminal, with VirusTotal reporting the malware as a Trojan/information stealer.
• The site, built on WordPress/WooCommerce and Ghost CMS, was taken offline after disclosure, linking the incident to wider exploitation of Ghost CMS in ongoing ClickFix campaigns.

Based Apparel, an American online clothing company selling patriotic, conservative and pro-free speech products, was apparently compromised and used to distribute malware via the ClickFix technique – but only macOS users were targeted.

A researcher using the pseudonym “Debbie” disclosed her findings to PC Magbefore sharing video evidence about