macOS ClickFix Campaign Silently Mounts Malicious DMGs (hdiutil attach -nobrowse) to Deploy Atomic macOS Stealer (AMOS)
macOS ClickFix Campaign Silently Mounts Malicious DMGs (TL-2026-0923), also tracked as ClickFix AMOS DMG campaign, is a high-severity malware campaign, first published 2026-06-23. It has no confirmed attribution, affects Apple macOS, maps to 24 MITRE ATT&CK techniques (T1005, T1030, T1033), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-0923
- Threat ID
- TL-2026-0923
- Also known as
- ClickFix AMOS DMG campaign, Atomic macOS Stealer ClickFix
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-23
- Last reviewed
- 2026-06-23
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, technology, finance, consumer, media
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in macOS ClickFix Campaign Silently Mounts Malicious DMGs
Malware and tooling: AMOS
A social-engineering (ClickFix) campaign tracked by Palo Alto Networks Unit 42 lures macOS users with fake CAPTCHA / verification pages that instruct victims to paste a Terminal command. The command silently downloads, mounts (hdiutil attach -nobrowse), and launches a malicious disk image carrying the Atomic macOS Stealer (AMOS), which exfiltrates browser credentials, cryptocurrency wallets, Keychain data, messaging-app data, and documents.
How macOS ClickFix Campaign Silently Mounts Malicious DMGs works
This campaign is the latest evolution of ClickFix social engineering targeting macOS, delivering the Atomic macOS Stealer (AMOS) — a Go/C++ infostealer-and-backdoor first observed in April 2023 and sold as malware-as-a-service on hacker forums and Telegram. The infection begins with a fake CAPTCHA / human-verification page that instructs the victim to open Terminal and paste a 'verification' command. The pasted command uses curl with quiet flags (curl -fsSL) to fetch a malicious DMG (observed as s.01M0td.dmg) from attacker infrastructure into the world-writable /tmp directory under a random filename, then mounts it with the native macOS utility via 'hdiutil attach -nobrowse' so the volume never appears in Finder or on the desktop. A shell loop searches up to three directory levels of the mounted volume for a .app or .pkg (observed bundle: NNApp.app) and launches it with the macOS 'open' command, sidestepping the usual double-click Gatekeeper prompt.
Once running, AMOS harvests data from an extensive target list: Chromium-based browsers (Google Chrome, Microsoft Edge, Brave, Opera, Arc, Vivaldi, CocCoc, Yandex) for cookies, login databases, autofill, payment cards, and profile data; Firefox-family browsers (LibreWolf, SeaMonkey, Tor Browser, Waterfox, Zen); cryptocurrency wallets (Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, DashCore, Guarda, Binance Wallet, Dogecoin Wallet, TonKeeper); Telegram Desktop and Discord data; Apple Notes databases; Safari cookies and Keychain files; and documents (PDF/TXT/RTF). The stealer also replaces legitimate Ledger Live and Trezor Suite installations with trojanized versions to facilitate crypto theft. Collected data is bundled into a ZIP archive and uploaded to attacker-controlled servers.
Related AMOS clusters documented in 2026 add a Script Editor delivery variant (using the applescript:// URL scheme to evade macOS 26.4's Terminal paste-scanning) and a new persistence mechanism: a LaunchDaemon named com.finder.helper at /Library/LaunchDaemons/com.finder.helper.plist (RunAtLoad/KeepAlive true) installed with root:wheel ownership using a password harvested via fake dialog, which relaunches helper scripts (~/.agent, ~/.mainhelper) and stores the captured password in ~/.pass for reinfection. AMOS variants commonly remove the com.apple.quarantine extended attribute (xattr) and use osascript/AppleScript dialog boxes to phish the local account password. The campaign is actively evolving and infrastructure is rotating.
MITRE ATT&CK techniques used in TL-2026-0923
Collection
T1005 Data from Local System; T1119 Automated Collection; T1560.001 Archive via Utility
Exfiltration
T1030 Data Transfer Size Limits; T1041 Exfiltration Over C2 Channel
Discovery
T1033 System Owner/User Discovery; T1497 Virtualization/Sandbox Evasion
Credential Access
T1056.002 GUI Input Capture; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer
Defense Evasion
T1140 Deobfuscate/Decode Files or Information; T1564.001 Hidden Files and Directories
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
defense-impairment
T1222.002 Linux and Mac Permissions; T1553.001 Gatekeeper Bypass
Persistence
T1543.001 Launch Agent; T1543.004 Launch Daemon
Privilege Escalation
Affected products and versions in macOS ClickFix Campaign Silently Mounts Malicious DMGs
- Apple — macOS
Vulnerable versions: macOS (all currently supported, social-engineering based)
Fixed in: macOS 26.4 adds Terminal paste scanning (partial mitigation)
Remediation for macOS ClickFix Campaign Silently Mounts Malicious DMGs
Patches
- Update to macOS 26.4 or later, which adds Terminal paste-command scanning (note: Script Editor variant evades this)
Immediate actions
- Block the IOC domains and IPs (svs-verificationdate[.]beer, 196.251.107.171, dryvecar[.]com, wusetail[.]com, laislivon[.]com, systellis[.]com) at DNS/perimeter
- Alert and hunt for 'hdiutil attach -nobrowse' executed from a curl-spawned shell, and curl downloads of .dmg files into /tmp
- Educate users that no legitimate CAPTCHA or 'verification' ever requires pasting commands into Terminal or Script Editor
- Isolate any host that ran the ClickFix command; rotate all browser, Keychain, wallet, Telegram and Discord credentials from a clean device
Workarounds
- Monitor /Library/LaunchDaemons and ~/Library/LaunchAgents for new com.finder.helper or unknown plists with RunAtLoad/KeepAlive
- Detect and remove hidden helper artifacts ~/.agent, ~/.mainhelper, ~/.pass, ~/.logged
Longer-term hardening
- Deploy macOS EDR (e.g. Cortex XDR / Jamf Protect) with behavioral detection for AppleScript execution, anomalous file access, and LaunchDaemon creation
- Restrict execution of disk images and unsigned binaries via Gatekeeper hardening and allow-listing
- Move crypto holdings to hardware wallets and verify Ledger Live / Trezor Suite installers against vendor signatures
Weaknesses (CWE) in macOS ClickFix Campaign Silently Mounts Malicious DMGs
CWE-829, CWE-506, CWE-522
Timeline of macOS ClickFix Campaign Silently Mounts Malicious DMGs
- Atomic macOS Stealer (AMOS) first observed and sold as malware-as-a-service on hacker forums and Telegram.
- Proofpoint first observes the ClickFix social-engineering technique in the wild, deployed by initial access broker TA571 and the ClearFake cluster before it floods the threat landscape through October 2024.
- Moonlock reports AMOS shipping an embedded backdoor (hidden '.helper' binary plus '.agent' script, persisted via LaunchDaemon PLIST) enabling remote arbitrary command execution and reboot-surviving persistence — only the second known global-scale macOS backdoor campaign.
- Sophos documents the evolution of ClickFix social engineering delivering macOS infostealers.
- Datadog Security Labs reports tech-impersonator ClickFix lures pushing macOS infostealers.
- Jamf Threat Labs discloses a ClickFix variant using the Script Editor (applescript:// URL scheme) to deliver Atomic Stealer, evading Terminal paste scanning.
- Apple ships macOS 26.4 adding Terminal paste-command scanning as a partial ClickFix mitigation.
- Palo Alto Networks Unit 42 observes the in-the-wild ClickFix campaign using 'hdiutil attach -nobrowse' to silently mount malicious DMGs delivering AMOS.
- BleepingComputer and Unit 42 publicly disclose the silent-DMG-mount ClickFix campaign with IOCs (svs-verificationdate[.]beer, 196.251.107.171, s.01M0td.dmg, NNApp.app).
Sources cited for macOS ClickFix Campaign Silently Mounts Malicious DMGs
- New macOS ClickFix attack silently mounts DMGs to push infostealer
- Stealers on the Rise: A Closer Look at a Growing macOS Threat
- Atomic Stealer MacOS ClickFix Attack Bypasses Apple Security Warnings
- ClickFix Malware Uses macOS Script Editor to Deliver Atomic Stealer
- Atomic Stealer (AMOS) Returns: ClickFix, Trojanized Crypto Apps, and a New macOS Persistence Mechanism
- Tech impersonators: ClickFix and macOS infostealers
- Evil evolution: ClickFix and macOS infostealers
- An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via Cracked Apps
- Atomic macOS Stealer includes a backdoor for persistent access
- Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape
Threats related to macOS ClickFix Campaign Silently Mounts Malicious DMGs
- Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign
- macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync Infostealers
- ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with Trojanized Ledger/Trezor/Exodus Wallets and GoogleUpdate-Masqueraded Persistence
- ClickLock: New macOS Infostealer Uses ClickFix Lure and App-Killing LaunchAgents to Force Credential Entry
- Atomic MacOS (AMOS) Stealer Infection via Fake "macOS Toolkit" Terminal Command
- Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate
Detection coverage for TL-2026-0923
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0923 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0923
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.