Atomic Stealer (AMOS) macOS Campaign via ClickFix Script Editor Abuse

Atomic Stealer (AMOS) macOS Campaign via ClickFix Script (TL-2026-0336), also tracked as Atomic Stealer, is a high-severity malware campaign, first published 2026-04-08 and last reviewed 2026-08-02. It is attributed to AMOS MaaS Operators (Russia) with medium confidence, affects Apple macOS, maps to 35 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 73 indicators of compromise.

Key facts for TL-2026-0336

Threat ID
TL-2026-0336
Also known as
Atomic Stealer, AMOS, OSX.AMOS, MacSync Stealer, Matryoshka ClickFix
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-04-08
Last reviewed
2026-08-02
Attribution
AMOS MaaS Operators
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
technology, financial, cryptocurrency, media, freelance, creative
Target regions
North America, Europe, Asia Pacific, Global
Detection rules
9
Indicators of compromise
73
Updates
2026-08-02 · 2 updates · revalidated 2× · latest source

Malware and tooling in Atomic Stealer (AMOS) macOS Campaign via ClickFix Script

Malware and tooling: AMOS, Atomic Stealer

A new campaign delivers Atomic Stealer (AMOS) malware to macOS users by abusing the built-in Script Editor via applescript:// URL scheme in a ClickFix social engineering attack. Victims are lured to fake Apple-themed pages that trigger Script Editor to execute obfuscated curl|zsh payloads, downloading a Mach-O binary to /tmp/helper. The stealer exfiltrates Keychain data, browser credentials, cryptocurrency wallets, and system information, with recent variants adding a LaunchDaemon-based backdoor for persistent access.

How Atomic Stealer (AMOS) macOS Campaign via ClickFix Script works

Atomic Stealer (AMOS) is a macOS-targeting infostealer sold as Malware-as-a-Service (MaaS) at approximately $3,000/month. First observed in early 2023, AMOS has undergone significant evolution through 2024-2026, progressing from simple DMG-based distribution to sophisticated ClickFix social engineering campaigns.

In this campaign variant reported in April 2026, threat actors abuse macOS Script Editor through the applescript:// URI scheme — a novel technique that bypasses the traditional ClickFix approach of instructing victims to paste commands into Terminal. Instead, visiting a malicious webpage triggers the Script Editor application directly, executing an obfuscated AppleScript payload without requiring the user to manually open Terminal.

The infection chain begins when a victim visits a typosquatted or malvertised domain impersonating legitimate services (Apple disk cleanup utilities, AI tools, cryptocurrency platforms). The fake page presents a ClickFix-style social engineering prompt — typically a fake verification dialog or system error message. When the user interacts with the prompt, a JavaScript handler constructs an applescript:// URL that opens Script Editor and executes a curl|zsh command pipeline.

The initial payload downloads and executes a multi-stage loader: Stage 1 fetches a shell script via curl from the C2 domain, which is piped to zsh for execution. Stage 2 uses nested base64 decoding and gunzip decompression (a "Matryoshka" layering technique) to unpack the actual AppleScript stealer payload entirely in memory, minimizing disk artifacts. Stage 3 executes the decompressed AppleScript via osascript, which performs the core malicious functions.

The stealer component displays a fake "System Preferences" password dialog using AppleScript's display dialog command with a hidden answer field, repeatedly prompting until the user enters valid credentials (validated via dscl . authonly). With the harvested password, the malware unlocks the macOS Keychain and extracts all stored credentials using the hardware UUID path.

Data collection targets include: all Keychain databases (*.keychain-db), Chromium-based browser data (Chrome, Brave, Edge, Opera, Vivaldi, Arc — cookies, login data, web data, history), Firefox data (logins.json, key4.db, cookies.sqlite), Safari cookies and form data, Apple Notes (NoteStore.sqlite with WAL/SHM files), Telegram tdata directory, Desktop and Documents files (.txt, .pdf, .docx, .wallet, .seed, .key, .kdbx — capped at 30MB), SSH keys, AWS/Kube config directories, and over 300 hardcoded cryptocurrency wallet browser extension IDs including MetaMask, Phantom, TronLink, Ronin, and Coinomi.

Desktop cryptocurrency wallets specifically targeted include: Electrum, Exodus, Atomic Wallet, Wasabi, Ledger Live, Monero, Bitcoin Core, Litecoin, Dash, Dogecoin, Trezor Suite, Sparrow, Coinomi, Binance, and TonKeeper. Recent variants go beyond theft — they download trojanized replacement applications for Ledger Live, Trezor Suite, and Exodus that contain malicious JavaScript designed to phish seed phrases and passwords on subsequent launches.

Collected data is staged in a temporary directory, compressed via ditto -c -k --sequesterRsrc to /tmp/out.zip (or /tmp/osalogging.zip in some variants), and exfiltrated via HTTP POST to the C2 server. Data is chunked to 25MB per request with 3 retries per chunk and automatic failover to a secondary C2 IP if the primary domain is unreachable.

The 2026 backdoor variant adds persistent access via a LaunchDaemon labeled com.finder.helper installed at /Library/LaunchDaemons/com.finder.helper.plist with RunAtLoad and KeepAlive set to true. This daemon executes /bin/bash ~/.agent, a wrapper script that polls the active console user via stat -f "%Su" /dev/console and relaunches the backdoor binary (~/.mainhelper or ~/.helper) in the user's context. The backdoor polls the C2 every 60 seconds for task assignments, supporting execute (arbitrary shell commands), pong (keepalive), repeat (repoll), and delete (self-destruct) operations. The backdoor binary performs VM detection via system_profiler checks for QEMU, VMware, and KVM processors before connecting to C2.

Anti-forensics measures include deletion of temporary staging directories, removal of /tmp/out.zip after exfiltration, cleanup of intermediate artifacts (/tmp/starter, ~/.agent, ~/.username), while preserving ~/.pass for credential caching across reinfections. The in-memory payload pipeline (base64+gzip+eval) and API-gated C2 communication (requiring custom headers) further complicate analysis.

Attribution points to Russian-speaking threat actors based on Russian language code comments, C2 infrastructure heavily concentrated in Russian hosting providers (Proton66 LLC, Media Land LLC, Stimul LLC), and operational patterns consistent with the broader AMOS MaaS ecosystem.

MITRE ATT&CK techniques used in TL-2026-0336

collection

T1005 Data from Local System; T1056 Input Capture; T1115 Clipboard Data; T1560 Archive Collected Data

Command and Control

T1008 Fallback Channels; T1105 Ingress Tool Transfer

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

exfiltration

T1041 Exfiltration Over C2 Channel

discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

execution

T1059 Command and Scripting Interpreter; T1204 User Execution

command-and-control

T1071 Application Layer Protocol; T1571 Non-Standard Port

Initial Access

T1189 Drive-by Compromise

Collection

T1213 Data from Information Repositories

Discovery

T1518 Software Discovery

Credential Access

T1539 Steal Web Session Cookie

Persistence

T1543 Create or Modify System Process

persistence

T1547 Boot or Logon Autostart Execution

privilege-escalation

T1548 Abuse Elevation Control Mechanism

credential-access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

defense-impairment

T1553 Subvert Trust Controls; T1685 Disable or Modify Tools

Defense Evasion

T1564 Hide Artifacts

initial-access

T1566 Phishing

stealth

T1574 Hijack Execution Flow

Resource Development

T1583 Acquire Infrastructure

Impact

T1657 Financial Theft

Affected products and versions in Atomic Stealer (AMOS) macOS Campaign via ClickFix Script

  • Apple — macOS
    Vulnerable versions: Monterey 12.x; Ventura 13.x; Sonoma 14.x; Sequoia 15.x
  • Google — Chrome (macOS)
    Vulnerable versions: All versions — credential/cookie theft target
  • Mozilla — Firefox (macOS)
    Vulnerable versions: All versions — credential/cookie theft target
  • Ledger — Ledger Live
    Vulnerable versions: All — trojanized replacement deployed
  • SatoshiLabs — Trezor Suite
    Vulnerable versions: All — trojanized replacement deployed
  • Exodus Movement — Exodus Wallet
    Vulnerable versions: All — trojanized replacement deployed

Remediation for Atomic Stealer (AMOS) macOS Campaign via ClickFix Script

Immediate actions

  • Block known C2 IPs at perimeter: 45.135.232.33, 92.246.136.14, 45.94.47.145-158, 45.94.47.204, 83.222.190.214, 185.39.206.183, 194.26.29.217, 88.214.50.3
  • Block known malicious domains: barbermoo.xyz, comparisions.org, macfilesendstream.com, wusetail.com, systellis.com, laislivon.com, isnimitz.com
  • Check for LaunchDaemon com.finder.helper at /Library/LaunchDaemons/com.finder.helper.plist
  • Scan for hidden files: ~/.helper, ~/.agent, ~/.mainhelper, ~/.username, ~/.id, ~/.pass
  • Audit /tmp/ for suspicious binaries (helper, starter, out.zip, osalogging.zip)
  • Revoke and rotate all credentials on affected macOS endpoints

Workarounds

  • Disable Script Editor via MDM profile or parental controls where not needed
  • Block applescript:// URL scheme at browser level via enterprise policy
  • Configure TCC to deny osascript access to sensitive directories
  • Use Jamf Protect or similar to block known AMOS behavioral patterns

Longer-term hardening

  • Deploy EDR with behavioral detection for osascript credential harvesting dialogs
  • Implement application allowlisting to block unsigned AppleScript execution
  • Configure web proxy to block applescript:// URI scheme invocations from browsers
  • Monitor for curl|zsh and curl|bash command patterns in endpoint telemetry
  • Deploy network monitoring for unencrypted HTTP POST exfiltration to non-standard ports
  • Enforce Gatekeeper and notarization requirements for all macOS endpoints

Weaknesses (CWE) in Atomic Stealer (AMOS) macOS Campaign via ClickFix Script

CWE-451, CWE-346

Timeline of Atomic Stealer (AMOS) macOS Campaign via ClickFix Script

Showing the 20 most recent tracked events.

  • AMOS operators begin adopting ClickFix social engineering technique, initially using Terminal paste approach
  • New AMOS variant leverages AppleScript-based ClickFix to target macOS users via typosquatted Spectrum domains
  • CloudSEK and cybersecuritynews.com report an earlier AMOS-via-ClickFix wave using Spectrum-themed typosquat domains (panel-spectrum.net, applemacios.com) and OS-based dynamic payload delivery.
  • First documented wave of the current AMOS/MacSync ClickFix malvertising campaign using GenAI-themed (ChatGPT/OpenAI) lures leading to fake install pages (Microsoft MSTIC).
  • Second campaign wave shifts to ChatGPT shared-conversation pages and fake GitHub installer interfaces; Telegram-bot-based real-time victim tracking added to C2 infrastructure.
  • Jamf Threat Labs flags ClickFix-based AMOS distribution, catalyzing industry-wide awareness of macOS ClickFix campaigns
  • Campaign evolves to Apple-branded site impersonation with Base64/Gzip multistage shell loaders and dynamic AppleScript payload retrieval executed in-memory via osascript.
  • Trend Micro discovers AMOS distribution via malicious OpenClaw AI agent skills, representing supply chain attack evolution
  • Moonlock identifies AMOS variant with LaunchDaemon-based backdoor (com.finder.helper) providing persistent remote access
  • Intego documents Matryoshka ClickFix variant using nested base64+gzip in-memory payload delivery via typosquatted domains
  • iru.com publishes a deep technical analysis documenting AMOS hardware-wallet trojanization (Ledger/Trezor/Exodus) and the two-stage LaunchDaemon persistence mechanism (com.finder.helper.plist).
  • Jamf Threat Labs reports attackers shifting the ClickFix paste target from Terminal to Script Editor specifically to bypass Apple's macOS 26.4 Terminal malicious-paste warning.
  • New campaign identified abusing applescript:// URL scheme to invoke Script Editor directly, bypassing Terminal-based ClickFix approach. Targets macOS users via fake Apple disk cleanup pages.
  • Netskope Threat Labs (via The Register) reports a related macOS ClickFix campaign using Spotlight-based paste execution and AppleScript stealers.
  • Sophos publishes a comprehensive AMOS writeup documenting anti-VM checks and C2 infrastructure (45.94.47.204, 38.244.158.56); AMOS accounted for ~40% of Sophos macOS malware protection events in 2025.
  • As of 2026-05-29, AMOS/Atomic Stealer remains highly active: the April 2026 Script Editor applescript:// ClickFix campaign was confirmed by Jamf, BleepingComputer and Microsoft, whose May 6 2026 blog reports the campaign ongoing and evolving with no arrests or takedown. As a no-CVE macOS MaaS (~40% of 2025 Mac detections), it cannot be patched away and operators keep rotating infrastructure.
  • Malware-Traffic-Analysis.net (Brad Duncan) captures and publishes a live infection: a malicious Google ad leads to a fake Homebrew (brew.sh clone) page; victim runs a ClickFix-style terminal command; AMOS installs and drops a persistence artifact named "starter".
  • Kaspersky publishes a blog on a current ClickFix fake-CAPTCHA campaign delivering AMOS with hardware-wallet trojanization and 200+ targeted crypto browser extensions.
  • Broadcom issues a protection bulletin confirming detection coverage for the AMOS ClickFix campaign.
  • GBHackers publishes coverage of the fake-CAPTCHA AMOS ClickFix campaign, corroborating the campaign remains active.

Update history for TL-2026-0336

Sources cited for Atomic Stealer (AMOS) macOS Campaign via ClickFix Script

Threats related to Atomic Stealer (AMOS) macOS Campaign via ClickFix Script

Detection coverage for TL-2026-0336

As of 2026-08-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0336 across Splunk SPL, Microsoft KQL and Sigma, covering 73 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats