ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with Trojanized Ledger/Trezor/Exodus Wallets and GoogleUpdate-Masqueraded Persistence
ClickFix macOS Trio (TL-2026-0471), also tracked as ClickFix macOS Trio, is a high-severity malware campaign, first published 2026-05-06. It has no confirmed attribution, affects Apple macOS, maps to 43 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 60 indicators of compromise.
Key facts for TL-2026-0471
- Threat ID
- TL-2026-0471
- Also known as
- ClickFix macOS Trio, SHub Stealer Loader Campaign, AMOS Helper Campaign, Macsync Stealer Campaign, GoogleUpdate LaunchAgent Backdoor, com.finder.helper LaunchDaemon
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-06
- Last reviewed
- 2026-05-06
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, fintech, consumer, developer-tools, creative, freelance, small-business
- Target regions
- North America, Europe, Latin America, Asia-Pacific, Global (excluding CIS)
- Detection rules
- 9
- Indicators of compromise
- 60
Malware and tooling in ClickFix macOS Trio
Malware and tooling: AMOS, Macsync Stealer, SHub Stealer, Telegram bot @ax03bot fallback C2
Microsoft Defender Security Research disclosed three concurrent ClickFix campaigns abusing fake macOS utility blogs on Squarespace, Medium, and Craft to trick users into pasting Base64-obfuscated curl-to-shell commands into Terminal, delivering SHub Stealer, AMOS, and Macsync Stealer. The malware harvests Keychain, browser, iCloud, Telegram, and 15+ cryptocurrency wallet artifacts; replaces Ledger, Trezor, and Exodus apps with trojanized clones; and persists via a fake com.google.keystone.agent LaunchAgent (GoogleUpdate masquerade) or com.finder.helper LaunchDaemon. Apple shipped a Terminal paste-blocked safety prompt in macOS 26.4 to mitigate the social-engineering vector.
How ClickFix macOS Trio works
## Overview
From late January through May 2026, Microsoft Defender Security Research tracked three concurrent ClickFix campaigns that target macOS users with fake disk-cleaner, system-optimizer, and AI-coding-tool tutorials hosted on Squarespace, Medium, Craft, and standalone domains (e.g., cleanmymacos[.]org). Each blog instructs the visitor to copy a Base64-obfuscated command into Terminal under the pretext of fixing storage issues or installing a helper utility. Pasting the command executes a curl-piped-to-shell loader that delivers one of three macOS infostealer families: SHub Stealer (Loader campaign), AMOS / Atomic Stealer (Helper campaign), or Macsync Stealer (related Loader variant). Because the user pastes into Terminal directly, the chain bypasses Gatekeeper, notarization, and Quarantine entirely.
## Loader Campaign (SHub Stealer / Macsync)
The Loader campaign delivers a zsh script that decodes Base64+gzip-compressed payloads, drops staging directories under /tmp/shub_<random-7-digit-ID>/, and harvests browser credentials, cookies, autofill, Keychain entries, iCloud account data, Telegram artifacts, and crypto wallet extensions (MetaMask, Phantom). Documents under 2MB (TXT, PDF, DOCX, KDBX, RTF) and media files (JPEG, PNG) are staged in /tmp/shub_*/FileGrabber/. The loader prompts the victim for their macOS account password under the guise of installing a helper utility, validating with `dscl . -authonly <username>` and emitting a `password_obtained` event to the C2.
Kill-switch: the Loader variant detects Russian/CIS keyboard layouts and exits with a `cis_blocked` telemetry event, indicating Russian-speaking operator alignment.
Persistence: ~/Library/LaunchAgents/com.google.keystone.agent.plist invokes a binary at ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate that beacons to [C2]/api/bot/heartbeat and executes Base64-decoded commands returned from the server, providing a long-lived backdoor.
Exfiltration: ZIP-compressed staging is uploaded via curl POST to [C2]/api/debug/event and [C2]/gate/chunk endpoints. C2 infrastructure includes rapidfilevault4[.]sbs, coco-fun2[.]com, nitlebuf[.]com, yablochnisok[.]com, mentaorb[.]com, seagalnssteavens[.]com, and 69+ additional rotating domains.
## Script Campaign
The Script campaign downloads a bash script (e.g., from cauterizespray[.]icu/script.sh or enslaveculprit[.]digital/script.sh) that pivots into heavily obfuscated AppleScript executed via osascript. The AppleScript iterates a hardcoded C2 candidate list (0x666[.]info, honestly[.]ink, pla7ina[.]cfd, play67[.]cc), performing curl connectivity tests with a Chrome user agent and a benign `check` POST body. If the hardcoded servers fail, it falls back to a Telegram bot (t[.]me/ax03bot) and parses the C2 endpoint from the bot page's `<span dir="auto">` element using sed.
Persistence: ~/Library/LaunchAgents/com.<random-value>.plist embeds the obfuscated AppleScript directly and re-executes it at login. Exfiltration is performed via curl POST to [C2]/upload.php. The Script campaign C2 IP is 95.85.251[.]177.
## Helper Campaign (AMOS / Atomic Stealer)
The Helper campaign drops a Mach-O binary to /tmp/helper or /tmp/update, executes it, and stages stolen data for exfiltration to /contact endpoints. AMOS targets browser credentials, Keychain, and crypto wallets, and includes virtualization detection that aborts on QEMU, VMware, KVM, or generic `Virtual Machine` strings.
Wallet trojanization: AMOS replaces legitimate wallet bundles with attacker-controlled clones — Ledger Wallet.app is replaced with [C2]/zxc/app.zip, Trezor Suite.app with [C2]/zxc/apptwo.zip, and Exodus.app with [C2]/zxc/appex.zip. The trojanized apps preserve the user-facing UX while exfiltrating seed phrases and private keys on first unlock.
Persistence: a system-level LaunchDaemon at /Library/LaunchDaemons/com.finder.helper.plist supervises a wrapper script at ~/.agent and a backdoor Mach-O at ~/.mainhelper. The .agent shell relaunches .mainhelper if it crashes, providing crash-resilient persistence with elevated privileges.
Exfiltration: curl POST to [C2]/contact endpoints. Helper C2 infrastructure includes rvdownloads[.]com, famiode[.]com, contatoplus[.]com, woupp[.]com, saramoftah[.]com, ptrei[.]com, plus exfiltration to 138.124.93[.]32/contact, 168.100.9[.]122/contact, and bot communication to 45.94.47[.]204.
## Apple Mitigation: macOS 26.4 Paste-Blocked Prompt
Apple shipped a Terminal paste-blocked safeguard in macOS 26.4 that intercepts suspicious paste operations and presents the dialog: "Possible malware, Paste blocked. Your Mac has not been harmed. Scammers often encourage pasting text into Terminal to try and harm your Mac or compromise your privacy." The prompt directly addresses the ClickFix delivery mechanism by alerting users before execution, but does not retroactively protect users on macOS 26.3 or earlier or those who explicitly bypass the prompt.
## Defender Impact
The campaign represents a strategic shift away from .dmg-based delivery (which Gatekeeper blocks effectively) toward Terminal/osascript pasting (which Gatekeeper does not gate). The 75+ rotating domains, four observed payload SHA-256 hashes, and IP 45.94.47[.]204 form the public IOC core, but rotation is rapid. Defenders should hunt for the canonical persistence paths (com.google.keystone.agent.plist, com.finder.helper.plist, ~/.mainhelper, ~/.agent) and Terminal-pasted curl|bash patterns regardless of domain rotation.
MITRE ATT&CK techniques used in TL-2026-0471
Collection
T1005 Data from Local System; T1115 Clipboard Data; T1560.001 Archive Collected Data: Archive via Utility
Command and Control
T1008 Fallback Channels; T1071.001 Application Layer Protocol: Web Protocols; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1573.002 Asymmetric Cryptography
Defense Evasion
T1027 Obfuscated Files or Information; T1036.004 Masquerading: Masquerade Task or Service; T1036.005 Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks; T1497.003 Time Based Checks; T1564.001 Hide Artifacts: Hidden Files and Directories
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Credential Access
T1056.002 Input Capture: GUI Input Capture; T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Execution
T1059.002 Command and Scripting Interpreter: AppleScript; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1204.001 User Execution: Malicious Link; T1204.004 User Execution: Malicious Copy and Paste
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery; T1614.001 System Location Discovery: System Language Discovery
Initial Access
T1189 Drive-by Compromise; T1566.002 Phishing: Spearphishing Link
Persistence
T1543.004 Create or Modify System Process: Launch Daemon; T1547.015 Login Items
defense-impairment
T1553.006 Code Signing Policy Modification
Resource Development
T1583 Acquire Infrastructure; T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services; T1587.001 Develop Capabilities: Malware
Impact
Affected products and versions in ClickFix macOS Trio
- Apple — macOS
Vulnerable versions: macOS 13 Ventura; macOS 14 Sonoma; macOS 15 Sequoia; macOS 26.0; macOS 26.1; macOS 26.2; macOS 26.3
Fixed in: macOS 26.4 (mitigated via Terminal paste-blocked prompt) - Ledger — Ledger Live (Wallet.app)
Vulnerable versions: all macOS versions trojanized via app.zip clone - SatoshiLabs — Trezor Suite
Vulnerable versions: all macOS versions trojanized via apptwo.zip clone - Exodus Movement — Exodus Wallet
Vulnerable versions: all macOS versions trojanized via appex.zip clone - Google — Chrome / Chromium browsers (credential targets)
Vulnerable versions: all macOS versions - ConsenSys — MetaMask browser extension
Vulnerable versions: all - Phantom Technologies — Phantom Wallet browser extension
Vulnerable versions: all
Remediation for ClickFix macOS Trio
Patches
- Apple macOS 26.4 — Terminal paste-blocked prompt
- Microsoft Defender for Endpoint signatures: Trojan:MacOS/Multiverze, Trojan:MacOS/SuspMalScript, Behavior:MacOS/SuspAmosExecution, Behavior:MacOS/SuspOsascriptExec, Behavior:MacOS/SuspDownloadFileExec
Immediate actions
- Block the 75+ campaign domains and IPs (45.94.47.204, 95.85.251.177, 138.124.93.32, 168.100.9.122) at perimeter and DNS
- Hunt for ~/Library/LaunchAgents/com.google.keystone.agent.plist on managed macOS endpoints (legitimate Google Keystone uses different paths)
- Hunt for /Library/LaunchDaemons/com.finder.helper.plist, ~/.mainhelper, and ~/.agent — none are legitimate Apple components
- Scan for the four published SHA-256 payload hashes across endpoint storage
- Issue user advisory: never paste Terminal commands from unknown websites, regardless of how innocuous they appear
Workarounds
- Set Terminal to require an admin password before executing pasted multi-line commands (via custom shell init)
- Restrict osascript execution via TCC and Endpoint Security framework rules
- Disable LaunchAgent autoload for non-Apple-signed plists via mobileconfig
- Block outbound curl from user shell sessions to non-allowlisted domains via PF or EDR network rules
Longer-term hardening
- Roll out macOS 26.4 fleet-wide to inherit Apple's Terminal paste-blocked prompt
- Deploy MDM policy restricting Terminal usage to admins / disabling Terminal for standard users where feasible
- Deploy EDR with behavioral coverage for curl|bash, osascript-from-bash, and LaunchAgent/LaunchDaemon writes from non-installer processes
- Hardware wallets only — discourage Ledger/Trezor/Exodus desktop app reliance for high-value accounts; verify wallet app code-signing on every launch
- Deploy DNS-layer blocking with TI feeds covering newly registered .sbs, .icu, .cfd, .digital TLDs heavily abused in this campaign
- User awareness training specifically covering ClickFix social engineering
Weaknesses (CWE) in ClickFix macOS Trio
CWE-829, CWE-494, CWE-506, CWE-1021
Timeline of ClickFix macOS Trio
- Helper campaign (AMOS variant) first observed by Microsoft Defender Research delivering Mach-O binaries to /tmp/helper via fake macOS utility blogs.
- Loader campaign (SHub Stealer) escalates with rotating Squarespace and Medium fake tutorial pages and com.google.keystone.agent LaunchAgent persistence.
- Helper campaign transitions delivery filename from /tmp/helper to /tmp/update; LaunchDaemon path /Library/LaunchDaemons/com.finder.helper.plist remains constant.
- GBHackers publishes 'Malvertising Campaign Spreads AMOS Infostealer via Fake Text-Sharing Ads' tying ad-network distribution to AMOS Helper campaign.
- Malwarebytes publishes 'Fake CleanMyMac site installs SHub Stealer and backdoors crypto wallets,' first public naming of SHub Stealer and Ledger/Trezor/Exodus trojanization.
- IRU publishes 'Atomic Stealer (AMOS) returns' detailing wallet trojanization via app.zip / apptwo.zip / appex.zip clone delivery.
- Elastic Security Labs publishes 'Phantom in the vault' linking related macOS RAT delivery via Obsidian to broader ClickFix ecosystem.
- Apple ships macOS 26.4 with new Terminal paste-blocked safety prompt — direct mitigation for the ClickFix copy-paste-into-Terminal vector.
- Script campaign first observed using heavily obfuscated AppleScript delivered via curl from cauterizespray[.]icu and enslaveculprit[.]digital, with Telegram bot ax03bot fallback C2 discovery.
- Threadlinqs Intelligence Platform publishes TL-2026-0471 with full kill chain, MITRE mapping, IOCs, detections, and simulations.
- Microsoft Defender Security Research publishes consolidated report documenting all three campaigns (Loader, Script, Helper), 75+ domains, four payload SHA-256 hashes, IP 45.94.47[.]204, and full IOC set.
- As of 2026-05-29, this macOS ClickFix infostealer trio (SHub/AMOS/Macsync) remains active and has escalated: SentinelOne, BleepingComputer and Help Net Security (May 18-19, 2026) report a new "SHub Reaper"/v2.0 variant. It bypasses the cited macOS 26.4 Terminal paste-block by pivoting to the applescript:// URL scheme, with new C2 (hebsbsbzjsjshduxbs[.]xyz) and the same GoogleUpdate persistence.
Sources cited for ClickFix macOS Trio
- ClickFix campaign uses fake macOS utilities lures to deliver infostealers
- Fake CleanMyMac site installs SHub Stealer and backdoors crypto wallets
- Malvertising Campaign Spreads AMOS macOS Infostealer via Fake Text-Sharing Ads
- Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
- Atomic Stealer (AMOS) returns
- MITRE ATT&CK T1059.004 Unix Shell
- MITRE ATT&CK T1547.015 Login Items (LaunchAgent)
- Apple macOS 26.4 Release Notes (Terminal paste protection)
Threats related to ClickFix macOS Trio
- Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate
- macOS ClickFix Campaign Silently Mounts Malicious DMGs (hdiutil attach -nobrowse) to Deploy Atomic macOS Stealer (AMOS)
- macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync Infostealers
- Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign
- Atomic Stealer (AMOS) macOS Campaign via ClickFix Script Editor Abuse
- Atomic MacOS (AMOS) Stealer Infection via Fake "macOS Toolkit" Terminal Command
Detection coverage for TL-2026-0471
As of 2026-05-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0471 across Splunk SPL, Microsoft KQL and Sigma, covering 60 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.