# Atomic Stealer (AMOS) macOS Campaign via ClickFix Script Editor Abuse

> A new campaign delivers Atomic Stealer (AMOS) malware to macOS users by abusing the built-in Script Editor via applescript:// URL scheme in a ClickFix social engineering attack. Victims are lured to fake Apple-themed pages that trigger Script Editor to execute obfuscated curl|zsh payloads, downloading a Mach-O binary to /tmp/helper. The stealer exfiltrates Keychain data, browser credentials, cryptocurrency wallets, and system information, with recent variants adding a LaunchDaemon-based backdoor for persistent access.

- **Published:** 2026-04-08T12:00:00Z
- **Last reviewed:** 2026-08-02T09:49:58.806Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0336
- **ID:** TL-2026-0336
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** AMOS MaaS Operators (Russia)
- **Detections:** 9 · **IOCs:** 73 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Atomic Stealer (AMOS) is a macOS-targeting infostealer sold as Malware-as-a-Service (MaaS) at approximately $3,000/month. First observed in early 2023, AMOS has undergone significant evolution through 2024-2026, progressing from simple DMG-based distribution to sophisticated ClickFix social engineering campaigns.

In this campaign variant reported in April 2026, threat actors abuse macOS Script Editor through the applescript:// URI scheme — a novel technique that bypasses the traditional ClickFix approach of instructing victims to paste commands into Terminal. Instead, visiting a malicious webpage triggers the Script Editor application directly, executing an obfuscated AppleScript payload without requiring the user to manually open Terminal.

The infection chain begins when a victim visits a typosquatted or malvertised domain impersonating legitimate services (Apple disk cleanup utilities, AI tools, cryptocurrency platforms). The fake page presents a ClickFix-style social engineering prompt — typically a fake verification dialog or system error message. When the user interacts with the prompt, a JavaScript handler constructs an applescript:// URL that opens Script Editor and executes a curl|zsh command pipeline.

The initial payload downloads and executes a multi-stage loader: Stage 1 fetches a shell script via curl from the C2 domain, which is piped to zsh for execution. Stage 2 uses nested base64 decoding and gunzip decompression (a "Matryoshka" layering technique) to unpack the actual AppleScript stealer payload entirely in memory, minimizing disk artifacts. Stage 3 executes the decompressed AppleScript via osascript, which performs the core malicious functions.

The stealer component displays a fake "System Preferences" password dialog using AppleScript's display dialog command with a hidden answer field, repeatedly prompting until the user enters valid credentials (validated via dscl . authonly). With the harvested password, the malware unlocks the macOS Keychain and extracts all stored credentials using the hardware UUID path.

Data collection targets include: all Keychain databases (*.keychain-db), Chromium-based browser data (Chrome, Brave, Edge, Opera, Vivaldi, Arc — cookies, login data, web data, history), Firefox data (logins.json, key4.db, cookies.sqlite), Safari cookies and form data, Apple Notes (NoteStore.sqlite with WAL/SHM files), Telegram tdata directory, Desktop and Documents files (.txt, .pdf, .docx, .wallet, .seed, .key, .kdbx — capped at 30MB), SSH keys, AWS/Kube config directories, and over 300 hardcoded cryptocurrency wallet browser extension IDs including MetaMask, Phantom, TronLink, Ronin, and Coinomi.

Desktop cryptocurrency wallets specifically targeted include: Electrum, Exodus, Atomic Wallet, Wasabi, Ledger Live, Monero, Bitcoin Core, Litecoin, Dash, Dogecoin, Trezor Suite, Sparrow, Coinomi, Binance, and TonKeeper. Recent variants go beyond theft — they download trojanized replacement applications for Ledger Live, Trezor Suite, and Exodus that contain malicious JavaScript designed to phish seed phrases and passwords on subsequent launches.

Collected data is staged in a temporary directory, compressed via ditto -c -k --sequesterRsrc to /tmp/out.zip (or /tmp/osalogging.zip in some variants), and exfiltrated via HTTP POST to the C2 server. Data is chunked to 25MB per request with 3 retries per chunk and automatic failover to a secondary C2 IP if the primary domain is unreachable.

The 2026 backdoor variant adds persistent access via a LaunchDaemon labeled com.finder.helper installed at /Library/LaunchDaemons/com.finder.helper.plist with RunAtLoad and KeepAlive set to true. This daemon executes /bin/bash ~/.agent, a wrapper script that polls the active console user via stat -f "%Su" /dev/console and relaunches the backdoor binary (~/.mainhelper or ~/.helper) in the user's context. The backdoor polls the C2 every 60 seconds for task assignments, supporting execute (arbitrary shell commands), pong (keepalive), repeat (repoll), and delete (self-destruct) operations. The backdoor binary performs VM detection via system_profiler checks for QEMU, VMware, and KVM processors before connecting to C2.

Anti-forensics measures include deletion of temporary staging directories, removal of /tmp/out.zip after exfiltration, cleanup of intermediate artifacts (/tmp/starter, ~/.agent, ~/.username), while preserving ~/.pass for credential caching across reinfections. The in-memory payload pipeline (base64+gzip+eval) and API-gated C2 communication (requiring custom headers) further complicate analysis.

Attribution points to Russian-speaking threat actors based on Russian language code comments, C2 infrastructure heavily concentrated in Russian hosting providers (Proton66 LLC, Media Land LLC, Stimul LLC), and operational patterns consistent with the broader AMOS MaaS ecosystem.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1189 Drive-by Compromise
- T1543 Create or Modify System Process
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1105 Ingress Tool Transfer
- T1657 Financial Theft
- T1583 Acquire Infrastructure
- T1553 Subvert Trust Controls
- T1564 Hide Artifacts
- T1518 Software Discovery
- T1213 Data from Information Repositories
- T1008 Fallback Channels

## Sources

- [BleepingComputer: New macOS stealer campaign uses Script Editor in ClickFix attack](https://www.bleepingcomputer.com/news/security/new-macos-stealer-campaign-uses-script-editor-in-clickfix-attack/)
- [Hunt.io: ClickFix on macOS — AppleScript Stealer, Terminal Phishing, and C2 Infrastructure](https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing)
- [Moonlock: Atomic macOS Stealer includes a backdoor for persistent access](https://moonlock.com/amos-backdoor-persistent-access)
- [IRU: Atomic Stealer (AMOS) Returns — ClickFix, Trojanized Crypto Apps, and New Persistence](https://www.iru.com/blog/atomic-stealer-amos-returns)
- [Intego: Matryoshka ClickFix Variant Delivers macOS Stealer via Typosquatting](https://www.intego.com/mac-security-blog/matryoshka-clickfix-macos-stealer/)
- [Cognisys Labs: Deep Analysis of the Malicious AppleScript Payload (MacSync Stealer)](https://labs.cognisys.group/posts/Deep-Analysis-of-the-Malicious-AppleScript-Payload/)
- [ANY.RUN: ClickFix Hits macOS via AI Tools — Real Attack Analyzed](https://any.run/cybersecurity-blog/macos-clickfix-amos-attack/)
- [Picus Security: Atomic Stealer — Dissecting macOS Most Notorious Infostealer](https://www.picussecurity.com/resource/blog/atomic-stealer-amos-macos-threat-analysis)
- [SentinelOne: From AMOS to Poseidon — SOC Guide to Detecting macOS Atomic Stealers](https://www.sentinelone.com/blog/from-amos-to-poseidon-a-soc-teams-guide-to-detecting-macos-atomic-stealers-2024/)
- [Trend Micro: Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer](https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html)
- [Microsoft: Infostealers Without Borders — macOS, Python Stealers, and Platform Abuse](https://www.microsoft.com/en-us/security/blog/2026/02/02/infostealers-without-borders-macos-python-stealers-and-platform-abuse/)
- [Jamf Threat Labs: MacSync Stealer Evolves — From ClickFix to Code-Signed Swift Malware](https://www.jamf.com/blog/macsync-stealer-evolution-code-signed-swift-malware-analysis/)
- [ThreatFox IOC Database: osx.amos](https://threatfox.abuse.ch/browse/malware/osx.amos/)
- [Darktrace: Atomic Stealer Investigation of a Growing macOS Threat](https://www.darktrace.com/blog/atomic-stealer-darktraces-investigation-of-a-growing-macos-threat)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0336