Threat reportMalwareTL-2026-0923
macOS ClickFix Campaign Silently Mounts Malicious DMGs (hdiutil attach -nobrowse) to Deploy Atomic macOS Stealer (AMOS)
macOS ClickFix Campaign Silently Mounts Malicious DMGs (TL-2026-0923), also tracked as ClickFix AMOS DMG campaign, is a high-severity malware campaign, first published 2026-06-23. It has no confirmed attribution, affects Apple macOS, maps to 24 MITRE ATT&CK techniques (T1005, T1030, T1033), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 24MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-0923
- Threat ID
- TL-2026-0923
- Also known as
- ClickFix AMOS DMG campaign, Atomic macOS Stealer ClickFix
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, technology, finance, consumer, media
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in macOS ClickFix Campaign Silently Mounts Malicious DMGs
Malware and tooling: AMOS
How macOS ClickFix Campaign Silently Mounts Malicious DMGs works
A social-engineering (ClickFix) campaign tracked by Palo Alto Networks Unit 42 lures macOS users with fake CAPTCHA / verification pages that instruct victims to paste a Terminal command. The command silently downloads, mounts (hdiutil attach -nobrowse), and launches a malicious disk image carrying the Atomic macOS Stealer (AMOS), which exfiltrates browser credentials, cryptocurrency wallets, Keychain data, messaging-app data, and documents.
This campaign is the latest evolution of ClickFix social engineering targeting macOS, delivering the Atomic macOS Stealer (AMOS) — a Go/C++ infostealer-and-backdoor first observed in April 2023 and sold as malware-as-a-service on hacker forums and Telegram. The infection begins with a fake CAPTCHA / human-verification page that instructs the victim to open Terminal and paste a 'verification' command. The pasted command uses curl with quiet flags (curl -fsSL) to fetch a malicious DMG (observed as s.01M0td.dmg) from attacker infrastructure into the world-writable /tmp directory under a random filename, then mounts it with the native macOS utility via 'hdiutil attach -nobrowse' so the volume never appears in Finder or on the desktop. A shell loop searches up to three directory levels of the mounted volume for a .app or .pkg (observed bundle: NNApp.app) and launches it with the macOS 'open' command, sidestepping the usual double-click Gatekeeper prompt.
Once running, AMOS harvests data from an extensive target list: Chromium-based browsers (Google Chrome, Microsoft Edge, Brave, Opera, Arc, Vivaldi, CocCoc, Yandex) for cookies, login databases, autofill, payment cards, and profile data; Firefox-family browsers (LibreWolf, SeaMonkey, Tor Browser, Waterfox, Zen); cryptocurrency wallets (Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, DashCore, Guarda, Binance Wallet, Dogecoin Wallet, TonKeeper); Telegram Desktop and Discord data; Apple Notes databases; Safari cookies and Keychain files; and documents (PDF/TXT/RTF). The stealer also replaces legitimate Ledger Live and Trezor Suite installations with trojanized versions to facilitate crypto theft. Collected data is bundled into a ZIP archive and uploaded to attacker-controlled servers.
Related AMOS clusters documented in 2026 add a Script Editor delivery variant (using the applescript:// URL scheme to evade macOS 26.4's Terminal paste-scanning) and a new persistence mechanism: a LaunchDaemon named com.finder.helper at /Library/LaunchDaemons/com.finder.helper.plist (RunAtLoad/KeepAlive true) installed with root:wheel ownership using a password harvested via fake dialog, which relaunches helper scripts (~/.agent, ~/.mainhelper) and stores the captured password in ~/.pass for reinfection. AMOS variants commonly remove the com.apple.quarantine extended attribute (xattr) and use osascript/AppleScript dialog boxes to phish the local account password. The campaign is actively evolving and infrastructure is rotating.
MITRE ATT&CK techniques used in TL-2026-0923
Collection
T1005 Data from Local System; T1119 Automated Collection; T1560.001 Archive via Utility
Exfiltration
T1030 Data Transfer Size Limits; T1041 Exfiltration Over C2 Channel
Discovery
T1033 System Owner/User Discovery; T1497 Virtualization/Sandbox Evasion
Credential Access
T1056.002 GUI Input Capture; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer
Defense Evasion
T1140 Deobfuscate/Decode Files or Information; T1564.001 Hidden Files and Directories
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
defense-impairment
T1222.002 Linux and Mac Permissions; T1553.001 Gatekeeper Bypass
Persistence
T1543.001 Launch Agent; T1543.004 Launch Daemon
Privilege Escalation
Affected products and versions in macOS ClickFix Campaign Silently Mounts Malicious DMGs
- Apple — macOS
Vulnerable versions: macOS (all currently supported, social-engineering based)
Fixed in: macOS 26.4 adds Terminal paste scanning (partial mitigation)
Remediation for macOS ClickFix Campaign Silently Mounts Malicious DMGs
Patches
- Update to macOS 26.4 or later, which adds Terminal paste-command scanning (note: Script Editor variant evades this)
Immediate actions
- Block the IOC domains and IPs (svs-verificationdate[.]beer, 196.251.107.171, dryvecar[.]com, wusetail[.]com, laislivon[.]com, systellis[.]com) at DNS/perimeter
- Alert and hunt for 'hdiutil attach -nobrowse' executed from a curl-spawned shell, and curl downloads of .dmg files into /tmp
- Educate users that no legitimate CAPTCHA or 'verification' ever requires pasting commands into Terminal or Script Editor
- Isolate any host that ran the ClickFix command; rotate all browser, Keychain, wallet, Telegram and Discord credentials from a clean device
Workarounds
- Monitor /Library/LaunchDaemons and ~/Library/LaunchAgents for new com.finder.helper or unknown plists with RunAtLoad/KeepAlive
- Detect and remove hidden helper artifacts ~/.agent, ~/.mainhelper, ~/.pass, ~/.logged
Longer-term hardening
- Deploy macOS EDR (e.g. Cortex XDR / Jamf Protect) with behavioral detection for AppleScript execution, anomalous file access, and LaunchDaemon creation
- Restrict execution of disk images and unsigned binaries via Gatekeeper hardening and allow-listing
- Move crypto holdings to hardware wallets and verify Ledger Live / Trezor Suite installers against vendor signatures
Weaknesses (CWE) in macOS ClickFix Campaign Silently Mounts Malicious DMGs
Timeline of macOS ClickFix Campaign Silently Mounts Malicious DMGs
- Atomic macOS Stealer (AMOS) first observed and sold as malware-as-a-service on hacker forums and Telegram.
- Proofpoint first observes the ClickFix social-engineering technique in the wild, deployed by initial access broker TA571 and the ClearFake cluster before it floods the threat landscape through October 2024.
- Moonlock reports AMOS shipping an embedded backdoor (hidden '.helper' binary plus '.agent' script, persisted via LaunchDaemon PLIST) enabling remote arbitrary command execution and reboot-surviving persistence — only the second known global-scale macOS backdoor campaign.
- Sophos documents the evolution of ClickFix social engineering delivering macOS infostealers.
- Datadog Security Labs reports tech-impersonator ClickFix lures pushing macOS infostealers.
- Jamf Threat Labs discloses a ClickFix variant using the Script Editor (applescript:// URL scheme) to deliver Atomic Stealer, evading Terminal paste scanning.
- Apple ships macOS 26.4 adding Terminal paste-command scanning as a partial ClickFix mitigation.
- Palo Alto Networks Unit 42 observes the in-the-wild ClickFix campaign using 'hdiutil attach -nobrowse' to silently mount malicious DMGs delivering AMOS.
- BleepingComputer and Unit 42 publicly disclose the silent-DMG-mount ClickFix campaign with IOCs (svs-verificationdate[.]beer, 196.251.107.171, s.01M0td.dmg, NNApp.app).
Sources cited for macOS ClickFix Campaign Silently Mounts Malicious DMGs
- New macOS ClickFix attack silently mounts DMGs to push infostealer
- Stealers on the Rise: A Closer Look at a Growing macOS Threat
- Atomic Stealer MacOS ClickFix Attack Bypasses Apple Security Warnings
- ClickFix Malware Uses macOS Script Editor to Deliver Atomic Stealer
- Atomic Stealer (AMOS) Returns: ClickFix, Trojanized Crypto Apps, and a New macOS Persistence Mechanism
- Tech impersonators: ClickFix and macOS infostealers
- Evil evolution: ClickFix and macOS infostealers
- An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via Cracked Apps
- Atomic macOS Stealer includes a backdoor for persistent access
- Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape
Detection coverage for TL-2026-0923
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0923 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0923
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.