Atomic Stealer (AMOS) macOS Campaign via ClickFix Script Editor Abuse — Threadlinqs Intelligence
As of 2026-07-18, Atomic Stealer (AMOS) macOS Campaign via ClickFix Script Editor Abuse is a high-severity malware threat attributed to AMOS MaaS Operators (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 55 indicators of compromise.
Threat ID: TL-2026-0336 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Updated: 2026-07-18 · revalidated 1× · latest source
Attribution: AMOS MaaS Operators · Russia · FINANCIAL
A new campaign delivers Atomic Stealer (AMOS) malware to macOS users by abusing the built-in Script Editor via applescript:// URL scheme in a ClickFix social engineering attack. Victims are lured to
Atomic Stealer (AMOS) is a macOS-targeting infostealer sold as Malware-as-a-Service (MaaS) at approximately $3,000/month. First observed in early 2023, AMOS has undergone significant evolution through 2024-2026, progressing from simple DMG-based distribution to sophisticated ClickFix social engineering campaigns.
In this campaign variant reported in April 2026, threat actors abuse macOS Script Editor through the applescript:// URI scheme — a novel technique that bypasses the traditional ClickFix approach of instructing victims to paste commands into Terminal. Instead, visiting a malicious webpage triggers the Script Editor application directly, executing an obfuscated AppleScript payload without requiring the user to manually open Terminal.
The infection chain begins when a victim visits a typosquatted or malvertised domain impersonating legitimate services (Apple disk cleanup utilities, AI tools, cryptocurrency platforms). The fake page presents a ClickFix-style social engineering prompt — typically a fake verification dialog or system error message. When the user interacts with the prompt, a JavaScript handler constructs an applescript:// URL that opens Script Editor and executes a curl|zsh command pipeline.
The initial payload downloads and executes a multi-stage loader: Stage 1 fetches a shell script via curl from the C2 domain, which is piped to zsh for execution. Stage 2 uses nested base64 decoding and gunzip decompression (a "Matryoshka" layering technique) to unpack the actual AppleScript stealer payload entirely in memory, minimizing disk artifacts. Stage 3 executes the decompressed AppleScript via osascript, which performs the core malicious functions.
The stealer component displays a fake "System Preferences" password dialog using AppleScript's display dialog command with a hidden answer field, repeatedly prompting until the user enters valid credentials (validated via dscl . authonly). With the harvested password, the malware unlocks the macOS Keychain and extracts all stored credentials using the hardware UUID path.
Data collection targets include: all Keychain databases (*.keychain-db), Chromium-based browser data (Chrome, Brave, Edge, Opera, Vivaldi, Arc — cookies, login data, web data, history), Firefox data (logins.json, key4.db, cookies.sqlite), Safari cookies and form data, Apple Notes (NoteStore.sqlite with WAL/SHM files), Telegram tdata directory, Desktop and Documents files (.txt, .pdf, .docx, .wallet, .seed, .key, .kdbx — capped at 30MB), SSH keys, AWS/Kube config directories, and over 300 hardcoded cryptocurrency wallet browser extension IDs including MetaMask, Phantom, TronLink, Ronin, and Coinomi.
Desktop cryptocurrency wallets specifically targeted include: Electrum, Exodus, Atomic Wallet, Wasabi, Ledger Live, Monero, Bitcoin Core, Litecoin, Dash, Dogecoin, Trezor Suite, Sparrow, Coinomi, Binance, and TonKeeper. Recent variants go beyond theft — they download trojanized replacement applications for Ledger Live, Trezor Suite, and Exodus that contain malicious JavaScript designed to phish seed phrases and passwords on subsequent launches.
Collected data is staged in a temporary directory, compressed via ditto -c -k --sequesterRsrc to /tmp/out.zip (or /tmp/osalogging.zip in some variants), and exfiltrated via HTTP POST to the C2 server. Data is chunked to 25MB per request with 3 retries per chunk and automatic failover to a secondary C2 IP if the primary domain is unreachable.
The 2026 backdoor variant adds persistent access via a LaunchDaemon labeled com.finder.helper installed at /Library/LaunchDaemons/com.finder.helper.plist with RunAtLoad and KeepAlive set to true. This daemon executes /bin/bash ~/.agent, a wrapper script that polls the active console user via stat -f "%Su" /dev/console and relaunches the backdoor binary (~/.mainhelper or ~/.helper) in the user's context. The backdoor polls the C2 every 60 seconds for task assignments, supporting execute (arbitrary shell commands), pong (kee
Weaknesses (CWE)
CWE-451, CWE-346
Target sectors: technology, financial, cryptocurrency, media, freelance, creative
Target regions: North America, Europe, Asia Pacific, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 55 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1204, T1059, T1059, T1547, T1574, T1548, T1027, T1140, T1036