# ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with Trojanized Ledger/Trezor/Exodus Wallets and GoogleUpdate-Masqueraded Persistence

> Microsoft Defender Security Research disclosed three concurrent ClickFix campaigns abusing fake macOS utility blogs on Squarespace, Medium, and Craft to trick users into pasting Base64-obfuscated curl-to-shell commands into Terminal, delivering SHub Stealer, AMOS, and Macsync Stealer. The malware harvests Keychain, browser, iCloud, Telegram, and 15+ cryptocurrency wallet artifacts; replaces Ledger, Trezor, and Exodus apps with trojanized clones; and persists via a fake com.google.keystone.agent LaunchAgent (GoogleUpdate masquerade) or com.finder.helper LaunchDaemon. Apple shipped a Terminal paste-blocked safety prompt in macOS 26.4 to mitigate the social-engineering vector.

- **Published:** 2026-05-06T12:00:00Z
- **Last reviewed:** 2026-05-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0471
- **ID:** TL-2026-0471
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 60 (full data via the Threadlinqs MCP server — Purple tier)

## Description

## Overview

From late January through May 2026, Microsoft Defender Security Research tracked three concurrent ClickFix campaigns that target macOS users with fake disk-cleaner, system-optimizer, and AI-coding-tool tutorials hosted on Squarespace, Medium, Craft, and standalone domains (e.g., cleanmymacos[.]org). Each blog instructs the visitor to copy a Base64-obfuscated command into Terminal under the pretext of fixing storage issues or installing a helper utility. Pasting the command executes a curl-piped-to-shell loader that delivers one of three macOS infostealer families: SHub Stealer (Loader campaign), AMOS / Atomic Stealer (Helper campaign), or Macsync Stealer (related Loader variant). Because the user pastes into Terminal directly, the chain bypasses Gatekeeper, notarization, and Quarantine entirely.

## Loader Campaign (SHub Stealer / Macsync)

The Loader campaign delivers a zsh script that decodes Base64+gzip-compressed payloads, drops staging directories under /tmp/shub_<random-7-digit-ID>/, and harvests browser credentials, cookies, autofill, Keychain entries, iCloud account data, Telegram artifacts, and crypto wallet extensions (MetaMask, Phantom). Documents under 2MB (TXT, PDF, DOCX, KDBX, RTF) and media files (JPEG, PNG) are staged in /tmp/shub_*/FileGrabber/. The loader prompts the victim for their macOS account password under the guise of installing a helper utility, validating with `dscl . -authonly <username>` and emitting a `password_obtained` event to the C2.

Kill-switch: the Loader variant detects Russian/CIS keyboard layouts and exits with a `cis_blocked` telemetry event, indicating Russian-speaking operator alignment.

Persistence: ~/Library/LaunchAgents/com.google.keystone.agent.plist invokes a binary at ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate that beacons to [C2]/api/bot/heartbeat and executes Base64-decoded commands returned from the server, providing a long-lived backdoor.

Exfiltration: ZIP-compressed staging is uploaded via curl POST to [C2]/api/debug/event and [C2]/gate/chunk endpoints. C2 infrastructure includes rapidfilevault4[.]sbs, coco-fun2[.]com, nitlebuf[.]com, yablochnisok[.]com, mentaorb[.]com, seagalnssteavens[.]com, and 69+ additional rotating domains.

## Script Campaign

The Script campaign downloads a bash script (e.g., from cauterizespray[.]icu/script.sh or enslaveculprit[.]digital/script.sh) that pivots into heavily obfuscated AppleScript executed via osascript. The AppleScript iterates a hardcoded C2 candidate list (0x666[.]info, honestly[.]ink, pla7ina[.]cfd, play67[.]cc), performing curl connectivity tests with a Chrome user agent and a benign `check` POST body. If the hardcoded servers fail, it falls back to a Telegram bot (t[.]me/ax03bot) and parses the C2 endpoint from the bot page's `<span dir="auto">` element using sed.

Persistence: ~/Library/LaunchAgents/com.<random-value>.plist embeds the obfuscated AppleScript directly and re-executes it at login. Exfiltration is performed via curl POST to [C2]/upload.php. The Script campaign C2 IP is 95.85.251[.]177.

## Helper Campaign (AMOS / Atomic Stealer)

The Helper campaign drops a Mach-O binary to /tmp/helper or /tmp/update, executes it, and stages stolen data for exfiltration to /contact endpoints. AMOS targets browser credentials, Keychain, and crypto wallets, and includes virtualization detection that aborts on QEMU, VMware, KVM, or generic `Virtual Machine` strings.

Wallet trojanization: AMOS replaces legitimate wallet bundles with attacker-controlled clones — Ledger Wallet.app is replaced with [C2]/zxc/app.zip, Trezor Suite.app with [C2]/zxc/apptwo.zip, and Exodus.app with [C2]/zxc/appex.zip. The trojanized apps preserve the user-facing UX while exfiltrating seed phrases and private keys on first unlock.

Persistence: a system-level LaunchDaemon at /Library/LaunchDaemons/com.finder.helper.plist supervises a wrapper script at ~/.agent and a backdoor Mach-O at ~/.mainhelper. The .agent shell relaunches .mainhelper if it crashes, providing crash-resilient persistence with elevated privileges.

Exfiltration: curl POST to [C2]/contact endpoints. Helper C2 infrastructure includes rvdownloads[.]com, famiode[.]com, contatoplus[.]com, woupp[.]com, saramoftah[.]com, ptrei[.]com, plus exfiltration to 138.124.93[.]32/contact, 168.100.9[.]122/contact, and bot communication to 45.94.47[.]204.

## Apple Mitigation: macOS 26.4 Paste-Blocked Prompt

Apple shipped a Terminal paste-blocked safeguard in macOS 26.4 that intercepts suspicious paste operations and presents the dialog: "Possible malware, Paste blocked. Your Mac has not been harmed. Scammers often encourage pasting text into Terminal to try and harm your Mac or compromise your privacy." The prompt directly addresses the ClickFix delivery mechanism by alerting users before execution, but does not retroactively protect users on macOS 26.3 or earlier or those who explicitly bypass the prompt.

## Defender Impact

The campaign represents a strategic shift away from .dmg-based delivery (which Gatekeeper blocks effectively) toward Terminal/osascript pasting (which Gatekeeper does not gate). The 75+ rotating domains, four observed payload SHA-256 hashes, and IP 45.94.47[.]204 form the public IOC core, but rotation is rapid. Defenders should hunt for the canonical persistence paths (com.google.keystone.agent.plist, com.finder.helper.plist, ~/.mainhelper, ~/.agent) and Terminal-pasted curl|bash patterns regardless of domain rotation.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.001 Acquire Infrastructure: Domains
- T1583.006 Acquire Infrastructure: Web Services
- T1587.001 Develop Capabilities: Malware
- T1566.002 Phishing: Spearphishing Link
- T1189 Drive-by Compromise
- T1204.001 User Execution: Malicious Link
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.002 Command and Scripting Interpreter: AppleScript
- T1059.006 Command and Scripting Interpreter: Python
- T1547.015 Login Items
- T1543.004 Create or Modify System Process: Launch Daemon
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1036.004 Masquerading: Masquerade Task or Service
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1070.004 Indicator Removal: File Deletion
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks
- T1497.003 Time Based Checks
- T1553.006 Code Signing Policy Modification
- T1056.002 Input Capture: GUI Input Capture
- T1555.001 Credentials from Password Stores: Keychain
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1614.001 System Location Discovery: System Language Discovery
- T1518 Software Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1560.001 Archive Collected Data: Archive via Utility
- T1115 Clipboard Data
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.002 Bidirectional Communication
- T1008 Fallback Channels
- T1105 Ingress Tool Transfer
- T1573.002 Asymmetric Cryptography

## Sources

- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [Fake CleanMyMac site installs SHub Stealer and backdoors crypto wallets](https://www.malwarebytes.com/)
- [Malvertising Campaign Spreads AMOS macOS Infostealer via Fake Text-Sharing Ads](https://gbhackers.com/)
- [Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT](https://www.elastic.co/security-labs)
- [Atomic Stealer (AMOS) returns](https://www.iru.com/blog/atomic-stealer-amos-returns)
- [MITRE ATT&CK T1059.004 Unix Shell](https://attack.mitre.org/techniques/T1059/004/)
- [MITRE ATT&CK T1547.015 Login Items (LaunchAgent)](https://attack.mitre.org/techniques/T1547/015/)
- [Apple macOS 26.4 Release Notes (Terminal paste protection)](https://support.apple.com/en-us/macos)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0471