# macOS ClickFix Campaign Silently Mounts Malicious DMGs (hdiutil attach -nobrowse) to Deploy Atomic macOS Stealer (AMOS)

> A social-engineering (ClickFix) campaign tracked by Palo Alto Networks Unit 42 lures macOS users with fake CAPTCHA / verification pages that instruct victims to paste a Terminal command. The command silently downloads, mounts (hdiutil attach -nobrowse), and launches a malicious disk image carrying the Atomic macOS Stealer (AMOS), which exfiltrates browser credentials, cryptocurrency wallets, Keychain data, messaging-app data, and documents.

- **Published:** 2026-06-23T00:00:00Z
- **Last reviewed:** 2026-06-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0923
- **ID:** TL-2026-0923
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This campaign is the latest evolution of ClickFix social engineering targeting macOS, delivering the Atomic macOS Stealer (AMOS) — a Go/C++ infostealer-and-backdoor first observed in April 2023 and sold as malware-as-a-service on hacker forums and Telegram. The infection begins with a fake CAPTCHA / human-verification page that instructs the victim to open Terminal and paste a 'verification' command. The pasted command uses curl with quiet flags (curl -fsSL) to fetch a malicious DMG (observed as s.01M0td.dmg) from attacker infrastructure into the world-writable /tmp directory under a random filename, then mounts it with the native macOS utility via 'hdiutil attach -nobrowse' so the volume never appears in Finder or on the desktop. A shell loop searches up to three directory levels of the mounted volume for a .app or .pkg (observed bundle: NNApp.app) and launches it with the macOS 'open' command, sidestepping the usual double-click Gatekeeper prompt.

Once running, AMOS harvests data from an extensive target list: Chromium-based browsers (Google Chrome, Microsoft Edge, Brave, Opera, Arc, Vivaldi, CocCoc, Yandex) for cookies, login databases, autofill, payment cards, and profile data; Firefox-family browsers (LibreWolf, SeaMonkey, Tor Browser, Waterfox, Zen); cryptocurrency wallets (Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, DashCore, Guarda, Binance Wallet, Dogecoin Wallet, TonKeeper); Telegram Desktop and Discord data; Apple Notes databases; Safari cookies and Keychain files; and documents (PDF/TXT/RTF). The stealer also replaces legitimate Ledger Live and Trezor Suite installations with trojanized versions to facilitate crypto theft. Collected data is bundled into a ZIP archive and uploaded to attacker-controlled servers.

Related AMOS clusters documented in 2026 add a Script Editor delivery variant (using the applescript:// URL scheme to evade macOS 26.4's Terminal paste-scanning) and a new persistence mechanism: a LaunchDaemon named com.finder.helper at /Library/LaunchDaemons/com.finder.helper.plist (RunAtLoad/KeepAlive true) installed with root:wheel ownership using a password harvested via fake dialog, which relaunches helper scripts (~/.agent, ~/.mainhelper) and stores the captured password in ~/.pass for reinfection. AMOS variants commonly remove the com.apple.quarantine extended attribute (xattr) and use osascript/AppleScript dialog boxes to phish the local account password. The campaign is actively evolving and infrastructure is rotating.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1543.004 Launch Daemon
- T1543.001 Launch Agent
- T1548.003 Sudo and Sudo Caching
- T1553.001 Gatekeeper Bypass
- T1140 Deobfuscate/Decode Files or Information
- T1222.002 Linux and Mac Permissions
- T1564.001 Hidden Files and Directories
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1056.002 GUI Input Capture
- T1033 System Owner/User Discovery
- T1497 Virtualization/Sandbox Evasion
- T1005 Data from Local System
- T1119 Automated Collection
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1030 Data Transfer Size Limits

## Sources

- [New macOS ClickFix attack silently mounts DMGs to push infostealer](https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/)
- [Stealers on the Rise: A Closer Look at a Growing macOS Threat](https://unit42.paloaltonetworks.com/macos-stealers-growing/)
- [Atomic Stealer MacOS ClickFix Attack Bypasses Apple Security Warnings](https://www.infosecurity-magazine.com/news/atomic-stealer-macos-clickfix/)
- [ClickFix Malware Uses macOS Script Editor to Deliver Atomic Stealer](https://www.jamf.com/blog/clickfix-macos-script-editor-atomic-stealer/)
- [Atomic Stealer (AMOS) Returns: ClickFix, Trojanized Crypto Apps, and a New macOS Persistence Mechanism](https://www.iru.com/blog/atomic-stealer-amos-returns)
- [Tech impersonators: ClickFix and macOS infostealers](https://securitylabs.datadoghq.com/articles/tech-impersonators-clickfix-and-macos-infostealers/)
- [Evil evolution: ClickFix and macOS infostealers](https://www.sophos.com/en-us/blog/evil-evolution-clickfix-and-macos-infostealers)
- [An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via Cracked Apps](https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html)
- [Atomic macOS Stealer includes a backdoor for persistent access](https://moonlock.com/amos-backdoor-persistent-access)
- [Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape](https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0923