Loading story…
Microsoft reported that a macOS-focused ClickFix campaign evolved from openly serving fake download pages to using server-side browser fingerprinting that shows the malicious lure mainly to likely macOS victims. The operation used more than 250 look-alike domains, often following dictionary-style naming patterns that included the token file, and presented spoofed GitHub-themed pages with a fake Download for macOS prompt. Victims were tricked into pasting a Terminal command that fetched remote scripts and installed infostealers including Atomic Stealer (AMOS) and MacSync.
The gating logic collected browser, hardware, and anti-analysis signals before deciding whether to deliver the lure, including navigator data, WebGL GPU details, timezone, iframe status, touch support, console serialization behavior, and prototype-tamper checks; non-qualifying visitors were sent blank or benign decoy pages. Separate IOC material tied the same broader activity to additional macOS infostealer infrastructure, including SHub Stealer, suspected delivery and command-and-control domains, a SHA-256 sample hash, and capabilities such as screenshot capture, file download, command execution, and self-deletion, reinforcing that the campaign relied on rotating lure domains and stealthy staging to target macOS users.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
Cato Networks disclosed a macOS ClickFix campaign that used sponsored search results and fake Codex download pages on Google Sites to trick users into pasting a malicious Terminal command. The researchers identified multiple rotating infrastructure sets, path- and OS-aware gating, and strong overlap with Atomic macOS Stealer (AMOS) delivery patterns, including telemetry requests to /api/metrics/run?event=pasted and staged Mach-O payload delivery.
Microsoft Defender Experts linked more than 30 domains to MacSync Stealer by correlating recurring endpoint execution context and network traits across changing infrastructure. The report also confirmed active data exfiltration, describing chunked HTTP PUT uploads of stolen data and publishing point-in-time domain indicators tied to the malware.
Microsoft published technical details on the campaign's browser and anti-analysis fingerprinting, the fake GitHub-branded "Download for macOS" lure, and the multi-stage AMOS infection chain triggered by a pasted Terminal command. The company also released mitigation guidance, indicators of compromise, and Defender detection coverage.
Microsoft Threat Intelligence reported a macOS ClickFix campaign distributing infostealers including MacSync and Atomic Stealer (AMOS) through more than 250 look-alike domains. Microsoft said the operation had evolved from openly serving ClickFix lures to using a server-side fingerprinting gate that selectively exposed the malicious page to likely macOS users.
A GitHub gist-style collection documented macOS-focused ClickFix activity, identifying a GitHub-themed campaign delivering MacSync Stealer and a fake Apple security update lure delivering SHub Stealer v2.0. It also listed campaign domains, one SHub payload hash, and malware command capabilities.
A GitHub gist-style IOC compilation included a section titled "AMOS Stealer Domains dated 16.12.2025" and listed multiple domains associated with AMOS infrastructure. The note documented domains such as jmpbowl[.]xyz, jmpbowl[.]space, elfrodbloom[.]coupons, and several others.
Huntress reported a ClickFix-delivered Go-based macOS stealer that harvested browser passwords, Apple Keychain data, cached credentials, and cryptocurrency assets. The malware used a Terminal-delivered loader, a fake osascript error dialog for credential capture and persistence, and could selectively divert part of a cryptocurrency transaction before signing.
Huntress observed a FakeAgent campaign affecting more than 29 organizations in which a malicious Claude Artifact impersonated a Claude Desktop/Claude Cowork download page. Bing searchers were directed to the claude.ai-hosted lure, whose fake download redirected through downloading-api[.]it[.]com and ultimately delivered SectopRAT.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 74 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
15 references tracked. Mallory keeps watching after this page renders.
huntress.com
Open sourcehelpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcehuntress.com
Open sourcethehackernews.com
Open sourcemicrosoft.com
Open sourcegist.github.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Macfinger ClickFix** campaign compromises legitimate websites by injecting JavaScript that fingerprints visitors and selectively presents macOS users with a fake bot-protection page. The page uses ClickFix-style instructions to trick victims into executing a malicious shell script, which retrieves architecture-specific Mach-O payloads for Apple Silicon or Intel-based Macs. Post-compromise activity includes repeated telemetry and credential-submission requests to command-and-control infrastructure. Ransom-ISAC assessed the final payload as a variant of **Atomic macOS Stealer (AMOS)**, though observed indicators differ from previously tracked AMOS activity; investigators have released IOC, packet-capture, and collected-file archives to support detection and analysis.
Sep 28, 2026
Researchers reported **three ClickFix campaigns** that used social engineering rather than software exploitation to infect **macOS** users with the **MacSync** infostealer. The activity evolved over several months, beginning with fake sponsored search results for an **OpenAI Atlas** browser download hosted on fraudulent pages, then shifting to malicious workflows that abused shared **ChatGPT** conversations and GitHub-themed landing pages to make the infection chain appear legitimate. In each case, victims were instructed to open **Terminal** and paste commands, allowing the malware to be installed through user action instead of a traditional exploit. The most recent campaign introduced a more advanced **MacSync** variant with **multi-stage loaders**, **dynamic AppleScript payloads**, and **in-memory execution** intended to improve evasion and persistence. Reporting indicates the later activity targeted users in **Belgium, India, and parts of North and South America**, while researchers said it remains unclear whether all three campaigns were conducted by the same threat actor. The findings underscore a broader trend of attackers adapting **ClickFix** lures for macOS, using trusted platforms, sponsored links, and fake AI-tool installers to steal credentials and other sensitive data while bypassing file-based defenses by persuading users to execute the attack themselves.
Aug 19, 2026
Researchers reported multiple social-engineering campaigns targeting macOS users with **fake CAPTCHA** and **ClickFix** lures that trick victims into copying and pasting malicious commands into Terminal, shifting execution to the user and bypassing traditional app-download protections. One campaign delivered **Atomic macOS Stealer (AMOS)** through trojanized cracked applications and malicious Terminal instructions, stealing credentials, browser data, cryptocurrency wallets, Telegram data, VPN profiles, keychain contents, Apple Notes, and files from common user folders before compressing and exfiltrating them over HTTP/HTTPS. Trend Micro separately documented multistage fake CAPTCHA attacks that also led to infostealers and remote-access trojans, underscoring the broader use of human-verification themes to launch malware chains. A separate July 2026 macOS campaign used a fake **TrustKey** verification page on Cloudflare Pages, a Cloudflare Worker, and an AppleScript-based loader to install a persistent backdoor named **`bmodule`** via LaunchAgent persistence. The malware dynamically resolved live command-and-control infrastructure from a **Polygon** smart contract using an **EtherHiding** technique, then fingerprinted hosts, phished macOS login passwords, and fetched tasks to deploy AMOS variants, an interactive shell, or an **XMRig** cryptominer. Apple said **macOS Sequoia** has updated runtime protections, while incident reporting shows Terminal-based social-engineering chains remain effective because they rely on users to execute the malicious commands directly.
Aug 28, 2026