ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with Trojanized Ledger/Trezor/Exodus Wallets and GoogleUpdate-Masqueraded Persistence — Threadlinqs Intelligence
As of 2026-05-30, ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with Trojanized Ledger/Trezor/Exodus Wallets and GoogleUpdate-Masqueraded Persistence is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 60 indicators of compromise.
Threat ID: TL-2026-0471 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Microsoft Defender Security Research disclosed three concurrent ClickFix campaigns abusing fake macOS utility blogs on Squarespace, Medium, and Craft to trick users into pasting Base64-obfuscated
## Overview
From late January through May 2026, Microsoft Defender Security Research tracked three concurrent ClickFix campaigns that target macOS users with fake disk-cleaner, system-optimizer, and AI-coding-tool tutorials hosted on Squarespace, Medium, Craft, and standalone domains (e.g., cleanmymacos[.]org). Each blog instructs the visitor to copy a Base64-obfuscated command into Terminal under the pretext of fixing storage issues or installing a helper utility. Pasting the command executes a curl-piped-to-shell loader that delivers one of three macOS infostealer families: SHub Stealer (Loader campaign), AMOS / Atomic Stealer (Helper campaign), or Macsync Stealer (related Loader variant). Because the user pastes into Terminal directly, the chain bypasses Gatekeeper, notarization, and Quarantine entirely.
## Loader Campaign (SHub Stealer / Macsync)
The Loader campaign delivers a zsh script that decodes Base64+gzip-compressed payloads, drops staging directories under /tmp/shub_<random-7-digit-ID>/, and harvests browser credentials, cookies, autofill, Keychain entries, iCloud account data, Telegram artifacts, and crypto wallet extensions (MetaMask, Phantom). Documents under 2MB (TXT, PDF, DOCX, KDBX, RTF) and media files (JPEG, PNG) are staged in /tmp/shub_*/FileGrabber/. The loader prompts the victim for their macOS account password under the guise of installing a helper utility, validating with `dscl . -authonly <username>` and emitting a `password_obtained` event to the C2.
Kill-switch: the Loader variant detects Russian/CIS keyboard layouts and exits with a `cis_blocked` telemetry event, indicating Russian-speaking operator alignment.
Persistence: ~/Library/LaunchAgents/com.google.keystone.agent.plist invokes a binary at ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate that beacons to [C2]/api/bot/heartbeat and executes Base64-decoded commands returned from the server, providing a long-lived backdoor.
Exfiltration: ZIP-compressed staging is uploaded via curl POST to [C2]/api/debug/event and [C2]/gate/chunk endpoints. C2 infrastructure includes rapidfilevault4[.]sbs, coco-fun2[.]com, nitlebuf[.]com, yablochnisok[.]com, mentaorb[.]com, seagalnssteavens[.]com, and 69+ additional rotating domains.
## Script Campaign
The Script campaign downloads a bash script (e.g., from cauterizespray[.]icu/script.sh or enslaveculprit[.]digital/script.sh) that pivots into heavily obfuscated AppleScript executed via osascript. The AppleScript iterates a hardcoded C2 candidate list (0x666[.]info, honestly[.]ink, pla7ina[.]cfd, play67[.]cc), performing curl connectivity tests with a Chrome user agent and a benign `check` POST body. If the hardcoded servers fail, it falls back to a Telegram bot (t[.]me/ax03bot) and parses the C2 endpoint from the bot page's `<span dir="auto">` element using sed.
Persistence: ~/Library/LaunchAgents/com.<random-value>.plist embeds the obfuscated AppleScript directly and re-executes it at login. Exfiltration is performed via curl POST to [C2]/upload.php. The Script campaign C2 IP is 95.85.251[.]177.
## Helper Campaign (AMOS / Atomic Stealer)
The Helper campaign drops a Mach-O binary to /tmp/helper or /tmp/update, executes it, and stages stolen data for exfiltration to /contact endpoints. AMOS targets browser credentials, Keychain, and crypto wallets, and includes virtualization detection that aborts on QEMU, VMware, KVM, or generic `Virtual Machine` strings.
Wallet trojanization: AMOS replaces legitimate wallet bundles with attacker-controlled clones — Ledger Wallet.app is replaced with [C2]/zxc/app.zip, Trezor Suite.app with [C2]/zxc/apptwo.zip, and Exodus.app with [C2]/zxc/appex.zip. The trojanized apps preserve the user-facing UX while exfiltrating seed phrases and private keys on first unlock.
Persistence: a system-level LaunchDaemon at /Library/LaunchDaemons/com.finder.helper.plist supervises a wrapper script at ~/.agent and a backdoor Mach-O at ~/.mainhelper. The .
Weaknesses (CWE)
CWE-829, CWE-494, CWE-506, CWE-1021
Target sectors: cryptocurrency, fintech, consumer, developer-tools, creative, freelance, small-business
Target regions: North America, Europe, Latin America, Asia-Pacific, Global (excluding CIS)
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 60 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1583.001, T1583.006, T1587.001, T1566.002, T1189, T1204.001, T1204.004, T1059.004, T1059.002