Atomic Stealer (AMOS) macOS Campaign via ClickFix Script Editor Abuse
Atomic Stealer (AMOS) macOS Campaign via ClickFix Script (TL-2026-0336), also tracked as Atomic Stealer, is a high-severity malware campaign, first published 2026-04-08 and last reviewed 2026-08-02. It is attributed to AMOS MaaS Operators (Russia) with medium confidence, affects Apple macOS, maps to 35 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 73 indicators of compromise.
Key facts for TL-2026-0336
- Threat ID
- TL-2026-0336
- Also known as
- Atomic Stealer, AMOS, OSX.AMOS, MacSync Stealer, Matryoshka ClickFix
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-04-08
- Last reviewed
- 2026-08-02
- Attribution
- AMOS MaaS Operators
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, financial, cryptocurrency, media, freelance, creative
- Target regions
- North America, Europe, Asia Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 73
- Updates
- 2026-08-02 · 2 updates · revalidated 2× · latest source
Malware and tooling in Atomic Stealer (AMOS) macOS Campaign via ClickFix Script
Malware and tooling: AMOS, Atomic Stealer
A new campaign delivers Atomic Stealer (AMOS) malware to macOS users by abusing the built-in Script Editor via applescript:// URL scheme in a ClickFix social engineering attack. Victims are lured to fake Apple-themed pages that trigger Script Editor to execute obfuscated curl|zsh payloads, downloading a Mach-O binary to /tmp/helper. The stealer exfiltrates Keychain data, browser credentials, cryptocurrency wallets, and system information, with recent variants adding a LaunchDaemon-based backdoor for persistent access.
How Atomic Stealer (AMOS) macOS Campaign via ClickFix Script works
Atomic Stealer (AMOS) is a macOS-targeting infostealer sold as Malware-as-a-Service (MaaS) at approximately $3,000/month. First observed in early 2023, AMOS has undergone significant evolution through 2024-2026, progressing from simple DMG-based distribution to sophisticated ClickFix social engineering campaigns.
In this campaign variant reported in April 2026, threat actors abuse macOS Script Editor through the applescript:// URI scheme — a novel technique that bypasses the traditional ClickFix approach of instructing victims to paste commands into Terminal. Instead, visiting a malicious webpage triggers the Script Editor application directly, executing an obfuscated AppleScript payload without requiring the user to manually open Terminal.
The infection chain begins when a victim visits a typosquatted or malvertised domain impersonating legitimate services (Apple disk cleanup utilities, AI tools, cryptocurrency platforms). The fake page presents a ClickFix-style social engineering prompt — typically a fake verification dialog or system error message. When the user interacts with the prompt, a JavaScript handler constructs an applescript:// URL that opens Script Editor and executes a curl|zsh command pipeline.
The initial payload downloads and executes a multi-stage loader: Stage 1 fetches a shell script via curl from the C2 domain, which is piped to zsh for execution. Stage 2 uses nested base64 decoding and gunzip decompression (a "Matryoshka" layering technique) to unpack the actual AppleScript stealer payload entirely in memory, minimizing disk artifacts. Stage 3 executes the decompressed AppleScript via osascript, which performs the core malicious functions.
The stealer component displays a fake "System Preferences" password dialog using AppleScript's display dialog command with a hidden answer field, repeatedly prompting until the user enters valid credentials (validated via dscl . authonly). With the harvested password, the malware unlocks the macOS Keychain and extracts all stored credentials using the hardware UUID path.
Data collection targets include: all Keychain databases (*.keychain-db), Chromium-based browser data (Chrome, Brave, Edge, Opera, Vivaldi, Arc — cookies, login data, web data, history), Firefox data (logins.json, key4.db, cookies.sqlite), Safari cookies and form data, Apple Notes (NoteStore.sqlite with WAL/SHM files), Telegram tdata directory, Desktop and Documents files (.txt, .pdf, .docx, .wallet, .seed, .key, .kdbx — capped at 30MB), SSH keys, AWS/Kube config directories, and over 300 hardcoded cryptocurrency wallet browser extension IDs including MetaMask, Phantom, TronLink, Ronin, and Coinomi.
Desktop cryptocurrency wallets specifically targeted include: Electrum, Exodus, Atomic Wallet, Wasabi, Ledger Live, Monero, Bitcoin Core, Litecoin, Dash, Dogecoin, Trezor Suite, Sparrow, Coinomi, Binance, and TonKeeper. Recent variants go beyond theft — they download trojanized replacement applications for Ledger Live, Trezor Suite, and Exodus that contain malicious JavaScript designed to phish seed phrases and passwords on subsequent launches.
Collected data is staged in a temporary directory, compressed via ditto -c -k --sequesterRsrc to /tmp/out.zip (or /tmp/osalogging.zip in some variants), and exfiltrated via HTTP POST to the C2 server. Data is chunked to 25MB per request with 3 retries per chunk and automatic failover to a secondary C2 IP if the primary domain is unreachable.
The 2026 backdoor variant adds persistent access via a LaunchDaemon labeled com.finder.helper installed at /Library/LaunchDaemons/com.finder.helper.plist with RunAtLoad and KeepAlive set to true. This daemon executes /bin/bash ~/.agent, a wrapper script that polls the active console user via stat -f "%Su" /dev/console and relaunches the backdoor binary (~/.mainhelper or ~/.helper) in the user's context. The backdoor polls the C2 every 60 seconds for task assignments, supporting execute (arbitrary shell commands), pong (keepalive), repeat (repoll), and delete (self-destruct) operations. The backdoor binary performs VM detection via system_profiler checks for QEMU, VMware, and KVM processors before connecting to C2.
Anti-forensics measures include deletion of temporary staging directories, removal of /tmp/out.zip after exfiltration, cleanup of intermediate artifacts (/tmp/starter, ~/.agent, ~/.username), while preserving ~/.pass for credential caching across reinfections. The in-memory payload pipeline (base64+gzip+eval) and API-gated C2 communication (requiring custom headers) further complicate analysis.
Attribution points to Russian-speaking threat actors based on Russian language code comments, C2 infrastructure heavily concentrated in Russian hosting providers (Proton66 LLC, Media Land LLC, Stimul LLC), and operational patterns consistent with the broader AMOS MaaS ecosystem.
MITRE ATT&CK techniques used in TL-2026-0336
collection
T1005 Data from Local System; T1056 Input Capture; T1115 Clipboard Data; T1560 Archive Collected Data
Command and Control
T1008 Fallback Channels; T1105 Ingress Tool Transfer
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
exfiltration
T1041 Exfiltration Over C2 Channel
discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1571 Non-Standard Port
Initial Access
Collection
T1213 Data from Information Repositories
Discovery
Credential Access
T1539 Steal Web Session Cookie
Persistence
T1543 Create or Modify System Process
persistence
T1547 Boot or Logon Autostart Execution
privilege-escalation
T1548 Abuse Elevation Control Mechanism
credential-access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
Defense Evasion
initial-access
stealth
Resource Development
Impact
Affected products and versions in Atomic Stealer (AMOS) macOS Campaign via ClickFix Script
- Apple — macOS
Vulnerable versions: Monterey 12.x; Ventura 13.x; Sonoma 14.x; Sequoia 15.x - Google — Chrome (macOS)
Vulnerable versions: All versions — credential/cookie theft target - Mozilla — Firefox (macOS)
Vulnerable versions: All versions — credential/cookie theft target - Ledger — Ledger Live
Vulnerable versions: All — trojanized replacement deployed - SatoshiLabs — Trezor Suite
Vulnerable versions: All — trojanized replacement deployed - Exodus Movement — Exodus Wallet
Vulnerable versions: All — trojanized replacement deployed
Remediation for Atomic Stealer (AMOS) macOS Campaign via ClickFix Script
Immediate actions
- Block known C2 IPs at perimeter: 45.135.232.33, 92.246.136.14, 45.94.47.145-158, 45.94.47.204, 83.222.190.214, 185.39.206.183, 194.26.29.217, 88.214.50.3
- Block known malicious domains: barbermoo.xyz, comparisions.org, macfilesendstream.com, wusetail.com, systellis.com, laislivon.com, isnimitz.com
- Check for LaunchDaemon com.finder.helper at /Library/LaunchDaemons/com.finder.helper.plist
- Scan for hidden files: ~/.helper, ~/.agent, ~/.mainhelper, ~/.username, ~/.id, ~/.pass
- Audit /tmp/ for suspicious binaries (helper, starter, out.zip, osalogging.zip)
- Revoke and rotate all credentials on affected macOS endpoints
Workarounds
- Disable Script Editor via MDM profile or parental controls where not needed
- Block applescript:// URL scheme at browser level via enterprise policy
- Configure TCC to deny osascript access to sensitive directories
- Use Jamf Protect or similar to block known AMOS behavioral patterns
Longer-term hardening
- Deploy EDR with behavioral detection for osascript credential harvesting dialogs
- Implement application allowlisting to block unsigned AppleScript execution
- Configure web proxy to block applescript:// URI scheme invocations from browsers
- Monitor for curl|zsh and curl|bash command patterns in endpoint telemetry
- Deploy network monitoring for unencrypted HTTP POST exfiltration to non-standard ports
- Enforce Gatekeeper and notarization requirements for all macOS endpoints
Weaknesses (CWE) in Atomic Stealer (AMOS) macOS Campaign via ClickFix Script
CWE-451, CWE-346
Timeline of Atomic Stealer (AMOS) macOS Campaign via ClickFix Script
Showing the 20 most recent tracked events.
- AMOS operators begin adopting ClickFix social engineering technique, initially using Terminal paste approach
- New AMOS variant leverages AppleScript-based ClickFix to target macOS users via typosquatted Spectrum domains
- CloudSEK and cybersecuritynews.com report an earlier AMOS-via-ClickFix wave using Spectrum-themed typosquat domains (panel-spectrum.net, applemacios.com) and OS-based dynamic payload delivery.
- First documented wave of the current AMOS/MacSync ClickFix malvertising campaign using GenAI-themed (ChatGPT/OpenAI) lures leading to fake install pages (Microsoft MSTIC).
- Second campaign wave shifts to ChatGPT shared-conversation pages and fake GitHub installer interfaces; Telegram-bot-based real-time victim tracking added to C2 infrastructure.
- Jamf Threat Labs flags ClickFix-based AMOS distribution, catalyzing industry-wide awareness of macOS ClickFix campaigns
- Campaign evolves to Apple-branded site impersonation with Base64/Gzip multistage shell loaders and dynamic AppleScript payload retrieval executed in-memory via osascript.
- Trend Micro discovers AMOS distribution via malicious OpenClaw AI agent skills, representing supply chain attack evolution
- Moonlock identifies AMOS variant with LaunchDaemon-based backdoor (com.finder.helper) providing persistent remote access
- Intego documents Matryoshka ClickFix variant using nested base64+gzip in-memory payload delivery via typosquatted domains
- iru.com publishes a deep technical analysis documenting AMOS hardware-wallet trojanization (Ledger/Trezor/Exodus) and the two-stage LaunchDaemon persistence mechanism (com.finder.helper.plist).
- Jamf Threat Labs reports attackers shifting the ClickFix paste target from Terminal to Script Editor specifically to bypass Apple's macOS 26.4 Terminal malicious-paste warning.
- New campaign identified abusing applescript:// URL scheme to invoke Script Editor directly, bypassing Terminal-based ClickFix approach. Targets macOS users via fake Apple disk cleanup pages.
- Netskope Threat Labs (via The Register) reports a related macOS ClickFix campaign using Spotlight-based paste execution and AppleScript stealers.
- Sophos publishes a comprehensive AMOS writeup documenting anti-VM checks and C2 infrastructure (45.94.47.204, 38.244.158.56); AMOS accounted for ~40% of Sophos macOS malware protection events in 2025.
- As of 2026-05-29, AMOS/Atomic Stealer remains highly active: the April 2026 Script Editor applescript:// ClickFix campaign was confirmed by Jamf, BleepingComputer and Microsoft, whose May 6 2026 blog reports the campaign ongoing and evolving with no arrests or takedown. As a no-CVE macOS MaaS (~40% of 2025 Mac detections), it cannot be patched away and operators keep rotating infrastructure.
- Malware-Traffic-Analysis.net (Brad Duncan) captures and publishes a live infection: a malicious Google ad leads to a fake Homebrew (brew.sh clone) page; victim runs a ClickFix-style terminal command; AMOS installs and drops a persistence artifact named "starter".
- Kaspersky publishes a blog on a current ClickFix fake-CAPTCHA campaign delivering AMOS with hardware-wallet trojanization and 200+ targeted crypto browser extensions.
- Broadcom issues a protection bulletin confirming detection coverage for the AMOS ClickFix campaign.
- GBHackers publishes coverage of the fake-CAPTCHA AMOS ClickFix campaign, corroborating the campaign remains active.
Update history for TL-2026-0336
- 2026-08-02 — macOS ClickFix Campaign Uses Fake CAPTCHAs to Deploy Atomic Stealer (AMOS) and Hijack Crypto Wallets: What changed Core fields unchanged (severity HIGH, exploitability ACTIVE, status ACTIVE). No downgrade or escalation of those fields is warranted by this report. The newer report does report a LOWER attribution_confidence (LOW vs. existing
- 2026-07-18 — Atomic macOS Stealer (AMOS) Delivered via Fake Homebrew Malvertising Page (ClickFix Terminal-Script Chain): What changed No field escalations: the new report's severity (MEDIUM) and attribution_confidence (LOW) are both lower-confidence restatements of an already-published HIGH/MEDIUM record and were not applied (no downgrades). Exploitability re
Sources cited for Atomic Stealer (AMOS) macOS Campaign via ClickFix Script
- BleepingComputer: New macOS stealer campaign uses Script Editor in ClickFix attack
- Hunt.io: ClickFix on macOS — AppleScript Stealer, Terminal Phishing, and C2 Infrastructure
- Moonlock: Atomic macOS Stealer includes a backdoor for persistent access
- IRU: Atomic Stealer (AMOS) Returns — ClickFix, Trojanized Crypto Apps, and New Persistence
- Intego: Matryoshka ClickFix Variant Delivers macOS Stealer via Typosquatting
- Cognisys Labs: Deep Analysis of the Malicious AppleScript Payload (MacSync Stealer)
- ANY.RUN: ClickFix Hits macOS via AI Tools — Real Attack Analyzed
- Picus Security: Atomic Stealer — Dissecting macOS Most Notorious Infostealer
- SentinelOne: From AMOS to Poseidon — SOC Guide to Detecting macOS Atomic Stealers
- Trend Micro: Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer
- Microsoft: Infostealers Without Borders — macOS, Python Stealers, and Platform Abuse
- Jamf Threat Labs: MacSync Stealer Evolves — From ClickFix to Code-Signed Swift Malware
- ThreatFox IOC Database: osx.amos
- Darktrace: Atomic Stealer Investigation of a Growing macOS Threat
Threats related to Atomic Stealer (AMOS) macOS Campaign via ClickFix Script
- macOS ClickFix Campaign: AppleScript Stealers Abuse Terminal and Script Editor Before macOS 26 Protections
- ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with Trojanized Ledger/Trezor/Exodus Wallets and GoogleUpdate-Masqueraded Persistence
- Anthropic claude.ai Shared-Chat Feature Abused in ClickFix Malvertising Campaign Delivering MacSync macOS Infostealer
- ClickFix macOS Script Editor Pivot — applescript:// Bypass of Tahoe Terminal Paste Warnings Delivers Atomic Stealer
- SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4 Terminal Mitigation via applescript:// URL Scheme, Spoofs Apple/Google/Microsoft (SentinelOne)
- macOS Info-Stealer Chains Fake Password Prompt, Telegram Session Theft, and Crypto Wallet App Replacement
Detection coverage for TL-2026-0336
As of 2026-08-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0336 across Splunk SPL, Microsoft KQL and Sigma, covering 73 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.