Loading story…
The Macfinger ClickFix campaign compromises legitimate websites by injecting JavaScript that fingerprints visitors and selectively presents macOS users with a fake bot-protection page. The page uses ClickFix-style instructions to trick victims into executing a malicious shell script, which retrieves architecture-specific Mach-O payloads for Apple Silicon or Intel-based Macs.
Post-compromise activity includes repeated telemetry and credential-submission requests to command-and-control infrastructure. Ransom-ISAC assessed the final payload as a variant of Atomic macOS Stealer (AMOS), though observed indicators differ from previously tracked AMOS activity; investigators have released IOC, packet-capture, and collected-file archives to support detection and analysis.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
On September 24, 2026, an active Macfinger ClickFix campaign delivered an unidentified information stealer to a physical macOS 27.0 host. Analysis found architecture-specific payload delivery, LaunchAgent persistence, credential and sensitive-folder access prompts, and HTTP/WebSocket C2 activity; the researcher assessed the malware was likely distinct from Atomic macOS Stealer.
Indicators for the Macfinger ClickFix campaign were observed, involving injected JavaScript on legitimate sites that fingerprinted visitors and presented selected macOS users with fake bot-protection instructions. Ransom-ISAC assessed the final payload as an Atomic macOS Stealer variant, while the author noted the indicators differed from a previously tracked AMOS campaign.
Observed infection traffic downloaded a shell-script downloader and architecture-specific Mach-O payloads from 45.150.33[.]128, then communicated with 95.163.153[.]80:8133. The C2 activity included telemetry requests, credential-related POST requests, and a request for a shell agent.
A notice provided password-protected archives containing indicators of compromise, packet-capture data, and collected files associated with Macfinger ClickFix activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
isc.sans.edu
Open sourcemalware-traffic-analysis.net
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported that a macOS-focused **ClickFix** campaign evolved from openly serving fake download pages to using server-side browser fingerprinting that shows the malicious lure mainly to likely macOS victims. The operation used more than **250 look-alike domains**, often following dictionary-style naming patterns that included the token `file`, and presented spoofed **GitHub-themed** pages with a fake **Download for macOS** prompt. Victims were tricked into pasting a Terminal command that fetched remote scripts and installed infostealers including **Atomic Stealer (AMOS)** and **MacSync**. The gating logic collected browser, hardware, and anti-analysis signals before deciding whether to deliver the lure, including `navigator` data, WebGL GPU details, timezone, iframe status, touch support, console serialization behavior, and prototype-tamper checks; non-qualifying visitors were sent blank or benign decoy pages. Separate IOC material tied the same broader activity to additional macOS infostealer infrastructure, including **SHub Stealer**, suspected delivery and command-and-control domains, a SHA-256 sample hash, and capabilities such as screenshot capture, file download, command execution, and self-deletion, reinforcing that the campaign relied on rotating lure domains and stealthy staging to target macOS users.
Aug 27, 2026
A **ClickFix** social-engineering campaign is targeting macOS users with fake CAPTCHA or verification prompts that instruct victims to copy and paste commands into **Terminal**. The pasted command downloads a malicious `.dmg`, mounts it invisibly, and launches an app or installer that deploys **Atomic macOS Stealer** (`AMOS`). The activity relies on user manipulation rather than a software vulnerability, marking an expansion of ClickFix-style lures onto Apple systems. Once installed, `AMOS` steals browser credentials, cookies, payment data, files, Apple ecosystem data, messaging-app content, and cryptocurrency wallet information from targets including **Safari**, **Apple Notes**, **Apple Keychain**, **Telegram**, **Discord**, and wallet-related browser extensions. Reports say the malware can also show a fake macOS authentication prompt to gain elevated access, archive stolen data into a ZIP file, and exfiltrate it to attacker-controlled servers; in some cases it also replaces legitimate **Ledger Wallet** and **Trezor Suite** applications with trojanized versions to enable further theft.
Jul 30, 2026
Researchers identified a **ClickFix-style** campaign targeting macOS users that swaps Terminal-based execution for **Script Editor** to bypass newer Apple protections. Victims are lured to fake Apple-themed pages such as “Reclaim disk space on your Mac,” which invoke the `applescript://` URL scheme and open Script Editor with a pre-filled AppleScript. If the user runs it, the script conceals a malicious shell command that decodes a URL, uses `curl` with TLS certificate validation disabled, and pipes the response directly into `zsh` for in-memory execution. The activity, discovered by **Jamf Threat Labs**, ultimately downloads and launches a Mach-O variant of **Atomic Stealer**, an infostealer built to harvest browser credentials, saved passwords, cryptocurrency wallets, and other sensitive data from macOS systems. Researchers said the campaign appears to be an adaptation to Apple’s paste-command scanning protections added in macOS 26.4 for Terminal abuse; while newer macOS versions also warn about unidentified scripts, the attack can still succeed if users follow the prompts. Reported infrastructure tied to the campaign includes `dryvecar.com`, `storage-fixes.squarespace.com`, and `cleanupmac.mssg.me`.
Jun 29, 2026