Loading story…
Microsoft reported that a macOS-focused ClickFix campaign evolved from openly serving fake download pages to using server-side browser fingerprinting that shows the malicious lure mainly to likely macOS victims. The operation used more than 250 look-alike domains, often following dictionary-style naming patterns that included the token file, and presented spoofed GitHub-themed pages with a fake Download for macOS prompt. Victims were tricked into pasting a Terminal command that fetched remote scripts and installed infostealers including Atomic Stealer (AMOS) and MacSync.
The gating logic collected browser, hardware, and anti-analysis signals before deciding whether to deliver the lure, including navigator data, WebGL GPU details, timezone, iframe status, touch support, console serialization behavior, and prototype-tamper checks; non-qualifying visitors were sent blank or benign decoy pages. Separate IOC material tied the same broader activity to additional macOS infostealer infrastructure, including SHub Stealer, suspected delivery and command-and-control domains, a SHA-256 sample hash, and capabilities such as screenshot capture, file download, command execution, and self-deletion, reinforcing that the campaign relied on rotating lure domains and stealthy staging to target macOS users.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft published technical details on the campaign's browser and anti-analysis fingerprinting, the fake GitHub-branded "Download for macOS" lure, and the multi-stage AMOS infection chain triggered by a pasted Terminal command. The company also released mitigation guidance, indicators of compromise, and Defender detection coverage.
Microsoft Threat Intelligence reported a macOS ClickFix campaign distributing infostealers including MacSync and Atomic Stealer (AMOS) through more than 250 look-alike domains. Microsoft said the operation had evolved from openly serving ClickFix lures to using a server-side fingerprinting gate that selectively exposed the malicious page to likely macOS users.
A GitHub gist-style collection documented macOS-focused ClickFix activity, identifying a GitHub-themed campaign delivering MacSync Stealer and a fake Apple security update lure delivering SHub Stealer v2.0. It also listed campaign domains, one SHub payload hash, and malware command capabilities.
A GitHub gist-style IOC compilation included a section titled "AMOS Stealer Domains dated 16.12.2025" and listed multiple domains associated with AMOS infrastructure. The note documented domains such as jmpbowl[.]xyz, jmpbowl[.]space, elfrodbloom[.]coupons, and several others.
Huntress reported a ClickFix-delivered Go-based macOS stealer that harvested browser passwords, Apple Keychain data, cached credentials, and cryptocurrency assets. The malware used a Terminal-delivered loader, a fake osascript error dialog for credential capture and persistence, and could selectively divert part of a cryptocurrency transaction before signing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcebleepingcomputer.com
Open sourceblog.netomize.ca
Open sourcecybersecuritynews.com
Open sourcehuntress.com
Open sourcethehackernews.com
Open sourcemicrosoft.com
Open sourcegist.github.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported **three ClickFix campaigns** that used social engineering rather than software exploitation to infect **macOS** users with the **MacSync** infostealer. The activity evolved over several months, beginning with fake sponsored search results for an **OpenAI Atlas** browser download hosted on fraudulent pages, then shifting to malicious workflows that abused shared **ChatGPT** conversations and GitHub-themed landing pages to make the infection chain appear legitimate. In each case, victims were instructed to open **Terminal** and paste commands, allowing the malware to be installed through user action instead of a traditional exploit. The most recent campaign introduced a more advanced **MacSync** variant with **multi-stage loaders**, **dynamic AppleScript payloads**, and **in-memory execution** intended to improve evasion and persistence. Reporting indicates the later activity targeted users in **Belgium, India, and parts of North and South America**, while researchers said it remains unclear whether all three campaigns were conducted by the same threat actor. The findings underscore a broader trend of attackers adapting **ClickFix** lures for macOS, using trusted platforms, sponsored links, and fake AI-tool installers to steal credentials and other sensitive data while bypassing file-based defenses by persuading users to execute the attack themselves.
Aug 5, 2026
A **ClickFix** social-engineering campaign is targeting macOS users with fake CAPTCHA or verification prompts that instruct victims to copy and paste commands into **Terminal**. The pasted command downloads a malicious `.dmg`, mounts it invisibly, and launches an app or installer that deploys **Atomic macOS Stealer** (`AMOS`). The activity relies on user manipulation rather than a software vulnerability, marking an expansion of ClickFix-style lures onto Apple systems. Once installed, `AMOS` steals browser credentials, cookies, payment data, files, Apple ecosystem data, messaging-app content, and cryptocurrency wallet information from targets including **Safari**, **Apple Notes**, **Apple Keychain**, **Telegram**, **Discord**, and wallet-related browser extensions. Reports say the malware can also show a fake macOS authentication prompt to gain elevated access, archive stolen data into a ZIP file, and exfiltrate it to attacker-controlled servers; in some cases it also replaces legitimate **Ledger Wallet** and **Trezor Suite** applications with trojanized versions to enable further theft.
Jul 30, 2026
Threat actors are running a **ClickFix**-style social-engineering campaign that abuses **Google sponsored search results** to funnel macOS users to malicious content hosted on legitimate platforms, including **Anthropic Claude public artifacts** (`claude.ai`) and **Medium** pages impersonating trusted sources (e.g., Apple Support). The lures target common search queries such as “online DNS resolver,” “macOS CLI disk space analyzer,” and “HomeBrew,” then instruct victims to paste and run Terminal commands that decode/execute payloads (e.g., `echo "..." | base64 -D | zsh` or `curl ... | zsh`). Researchers (Moonlock Lab/MacPaw and AdGuard) reported that the malicious Claude artifact accumulated **~12,300 to 15,600 views**, indicating significant exposure (reported as **10,000+** and **15,000+** potential victims across coverage). The payloads deliver macOS information-stealing malware, including **MacSync**, which collects data such as **Keychain credentials, browser data, and cryptocurrency wallet files**. Reported tradecraft includes downloading and executing a shell script, using an AppleScript component for theft, staging stolen data into `/tmp/osalogging.zip`, and exfiltrating via HTTP POST to attacker infrastructure (e.g., `a2abotnet[.]com/gate`, with C2 paths like `a2abotnet[.]com/dynamic`). The malware attempts to blend in by spoofing legitimate macOS browser User-Agent strings and includes retry logic for large/chunked uploads, then removes staging artifacts to reduce forensic traces.
Jun 29, 2026