Threat reportMalwareTL-2026-1894
macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync Infostealers
macOS ClickFix Campaign Using Browser Fingerprinting Gate to (TL-2026-1894) is a high-severity malware campaign, first published 2026-08-05. It has no confirmed attribution, affects Apple macOS, maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 39 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 25MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 39Indicators of compromise
Key facts for TL-2026-1894
- Threat ID
- TL-2026-1894
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, finance
- Target regions
- North America, Europe, Asia, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 39
Malware and tooling in macOS ClickFix Campaign Using Browser Fingerprinting Gate to
Malware and tooling: AMOS, MacSync, SHub Stealer
How macOS ClickFix Campaign Using Browser Fingerprinting Gate to works
Microsoft Threat Intelligence tracks an active macOS ClickFix campaign distributing Atomic Stealer (AMOS) and MacSync infostealers through 250+ algorithmically generated domains. The campaign evolved from openly serving malicious commands in page HTML to using a server-side browser-fingerprinting gate that profiles visitors via JavaScript (navigator, screen, window, document, location, console objects plus WebGL GPU hardware validation) before serving the ClickFix lure exclusively to genuine macOS browser users. The infection chain culminates in credential, browser data, cryptocurrency wallet, keychain, and SSH key theft via in-memory AppleScript execution and persistent backdoor deployment.
Microsoft Threat Intelligence published a detailed analysis on August 5, 2026 documenting an active macOS ClickFix campaign that has undergone a significant operational security evolution. The campaign, first tracked in its current form since early 2026, distributes the Atomic macOS Stealer (AMOS) and MacSync infostealer families through a cluster of over 250 look-alike domains using algorithmically generated naming patterns (e.g., filecopperbasket[.]sbs, filevelvettractor[.]sbs, applefilevault[.]com).
The campaign's most notable evolution is the adoption of a server-side Traffic Distribution System (TDS) gate. Earlier iterations openly served the malicious ClickFix lure in page HTML, allowing scanners and crawlers to recover the full attack from page source. The current variant returns a minimal ~2.5 KB JavaScript profiling routine to all visitors. This routine collects environmental data from six browser objects (navigator, screen, window, document, location, console), performs WebGL GPU hardware validation to distinguish real Apple hardware from virtualized or emulated environments, checks timezone offset for data-center anomalies, detects iframe embedding, checks for touch-input support atypical on desktop macOS, and deploys anti-analysis probes including a toString() counter to detect open developer consoles and a prototype-tamper probe using canPlayType() to detect instrumented JavaScript environments. The fingerprint is silently submitted to the server with a mode: php tag; only visitors whose profile matches a genuine macOS browser on real Apple hardware receive the ClickFix lure page.
Qualifying targets receive a counterfeit Verified Publisher / Download for macOS page featuring GitHub-themed branding. The victim is instructed to open Terminal and run a command that downloads a multi-stage payload chain. In the AMOS variant (Helper Install campaign, active since January 2026), the first-stage script decodes Base64+Gzip content, downloads a Mach-O executable to /tmp/helper or /tmp/update, strips extended attributes (bypassing Gatekeeper), and launches it. The payload performs anti-VM checks using system_profiler for QEMU, VMware, and KVM indicators. It prompts for the macOS password and validates it via dscl . -authonly, storing the validated password in ~/.pass. AMOS then collects macOS Keychain databases, Chromium-based browser credentials/cookies/autofill, Apple Notes, cryptocurrency wallet data (browser extensions including MetaMask and Phantom, desktop wallets including Exodus and Electrum), and host system profile including IOPlatformUUID. Data is compressed to /tmp/out.zip via ditto and exfiltrated to a C2 /contact endpoint. AMOS establishes persistence via a LaunchDaemon at /Library/LaunchDaemons/com.finder.helper.plist running a .mainhelper backdoor that beacons to 45.94.47[.]204/api/tasks/ for remote command execution.
The MacSync variant (Loader Install campaign, active since February 2026) uses a similar curl-to-shell approach but delivers a multi-stage AppleScript infostealer executed entirely in memory via osascript. The loader first performs reconnaissance — checking keyboard locale, hostname, OS version, and external IP — and implements a Russian/CIS keyboard locale kill switch. The AppleScript payload harvests browser credentials, notes, media files, Telegram Desktop data, cryptocurrency wallets, keychain databases, and iCloud data. It specifically targets cryptocurrency hardware wallet applications (Ledger Live, Trezor Suite, Exodus) by downloading trojanized app.asar replacements from C2 infrastructure that inject seed-phrase exfiltration logic and re-sign with ad-hoc signatures to bypass macOS verification. Data is staged under /tmp/shub_<random ID>/, zipped, and exfiltrated. Persistence is achieved via a masqueraded Google Update agent at ~/Library/Application Support/Google/GoogleUpdate.app/ with a RunAtLoad plist.
A third variant (Script Install campaign, April 2026) executes entirely in memory with no payload written to disk in the initial stage. It uses a dual-mechanism C2 discovery approach — first probing hardcoded servers, then falling back to Telegram-based C2 discovery by scraping hxxps://t[.]me/ax03bot for hidden server identifiers. This variant pipes payloads directly into osascript for in-memory execution.
The campaign's 250+ domains use TLDs including .com, .sbs, and .online with naming patterns such as file<word><word> and algorithmically generated combinations. The infrastructure is protected by Cloudflare CDN. C2 infrastructure for the AMOS variant is hosted primarily in the 45.94.47.0/24 range (AS60781 LeaseWeb Netherlands / AS57043 Hostkey B.V.) with exfiltration endpoints spanning multiple IP ranges. No specific threat actor or nation-state has been attributed; the activity is consistent with cybercriminal MaaS operations given the use of commercial malware (AMOS, MacSync) available for purchase on underground forums.
Apple introduced a mitigation in macOS 26.4+ that displays a Possible malware, Paste blocked warning when users attempt to paste potentially malicious commands into Terminal, directly addressing the ClickFix delivery mechanism. Microsoft Defender for Endpoint provides coverage through detections including Behavior:MacOS/SuspAmosExecution, Behavior:MacOS/SuspOsascriptExec, Behavior:MacOS/SuspPassSteal, and Trojan:MacOS/SuspMacSyncExfil.
MITRE ATT&CK techniques used in TL-2026-1894
Collection
T1005 Data from Local System; T1213 Data from Information Repositories; T1560.001 Archive via Utility
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1497.001 System Checks; T1564.001 Hidden Files and Directories; T1622 Debugger Evasion
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery
Credential Access
T1056.002 GUI Input Capture; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1059.007 JavaScript; T1106 Native API; T1204.002 Malicious File
Persistence
T1543.001 Launch Agent; T1543.004 Launch Daemon
defense-impairment
Initial Access
Affected products and versions in macOS ClickFix Campaign Using Browser Fingerprinting Gate to
- Apple — macOS
Vulnerable versions: All versions prior to 26.4
Fixed in: macOS 26.4+ (paste warning mitigation does not prevent infection if user bypasses warning)
Remediation for macOS ClickFix Campaign Using Browser Fingerprinting Gate to
Patches
- Apply Apple macOS 26.4+ which includes paste-blocking mitigation for Terminal commands
Immediate actions
- Block the known ClickFix domain clusters at network perimeter (250+ file<word><word> domains, .sbs and .online TLDs)
- Block C2 IP ranges: 45.94.47.0/24, 109.107.181.0/24, 38.244.158.0/24
- Deploy browser extension to warn on file<word><word> domain patterns
- Review macOS endpoints for persistence artifacts: ~/Library/LaunchAgents/com.google.keystone.agent.plist, ~/Library/LaunchAgents/com.finder.helper.plist, ~/.mainhelper, ~/.agent
Workarounds
- Restrict outbound curl to approved CDNs and update servers only
- Deploy DNS filtering to block algorithmically generated domain patterns
- Enable Microsoft Defender for Endpoint block mode and tamper protection
- Use application allowlisting to prevent unsigned Mach-O execution in /tmp/
Longer-term hardening
- Educate all macOS users: no legitimate download, CAPTCHA, or verification requires pasting a Terminal command
- Deploy EDR with behavioral detection for curl|zsh, base64 -d | bash, osascript, dscl . -authonly sequences
- Monitor Terminal/shell sessions spawning curl, base64, gunzip, or osascript shortly after web browsing
- Implement alerting on archive creation (ditto, zip) followed by HTTP POST exfiltration
- Disable or restrict unsigned osascript execution for non-Apple processes
- Harden macOS keychain access monitoring for unauthorized read operations
- Audit outbound connections to newly registered domains and low-reputation IP spaces
Timeline of macOS ClickFix Campaign Using Browser Fingerprinting Gate to
- AMOS variant with macOS-specific User Agent lures documented by CloudSEK via ClickFix delivery on fake cloud storage pages
- Huntress publishes detailed reverse engineering of MacSync infostealer revealing six-stage kill chain including daemonized Zsh stagers, remote AppleScript, and cryptocurrency wallet targeting
- Sophos documents Campaign 1: MacSync delivered via OpenAI Atlas-themed Google sponsored search results with fake download pages on sites.google.com (abusing legitimate Google domain)
- Sophos documents Campaign 2: ChatGPT conversation lures on chatgpt.com redirecting to GitHub-themed MacSync landing pages; 50,000+ clicks tracked across 12 domains with Telegram-bot powered stats.php visitor tracking
- AMOS Helper Install campaign infrastructure becomes active per Microsoft tracking; C2 at 45.94.47.204 online; delivers .mainhelper backdoor via LaunchDaemon persistence
- MacSync Loader Install campaign goes active per Microsoft tracking; uses Base64+Gzip curled payloads with Russian/CIS keyboard locale kill switch and SHub infostealer component
- Sophos documents Campaign 3: Advanced MacSync variant using shell-based loaders only (no Mach-O binaries), in-memory AppleScript, chunked 10MB exfiltration, C2 API key gating, and Ledger wallet app.asar trojanization
- Sophos publishes Evil Evolution report detailing all three ClickFix+macOS infostealer campaigns across November 2025 to February 2026
- Microsoft tracks Script Install campaign variant: entirely diskless execution piped into shell; dual-mechanism C2 discovery using hardcoded server probes and Telegram bot fallback (t.me/ax03bot)
- Microsoft publishes detailed analysis of three ClickFix campaign variants (Loader, Script, Helper) distributing MacSync, SHub Stealer, and AMOS via fake macOS utility lures on Squarespace, Medium, and Craft
- Researcher brkalbyrk publishes GitHub gist with 306 unique ClickFix page domains and 2 C2 domains (share2e32git.sbs, plombirsirni.com) distributing MacSync and SHub Stealer
- Palo Alto Networks Unit 42 publishes MacSync stealer IOCs confirming continued activity; domains include cashlessend.com, cloudpuput.com, drivinguber.com with /curl/<sha256> staging URL pattern
- Netskope publishes analysis of macOS ClickFix lures deploying AppleScript stealer and persistent RAT, confirming continued evolution of the campaign
- Apple macOS 26.4+ introduces paste-blocking mitigation: Possible malware, Paste blocked warning when users attempt to paste potentially malicious commands into Terminal
- Microsoft publishes macOS ClickFix Campaign Learned to Hide documenting the evolution to server-side browser-fingerprinting TDS gate with WebGL GPU validation, toString() counter, prototype-tamper probes, and 250+ algorithmically generated domains
Sources cited for macOS ClickFix Campaign Using Browser Fingerprinting Gate to
- macOS ClickFix Campaign Learned to Hide — Microsoft Security Blog
- ClickFix Campaign Uses Fake macOS Utilities Lures — Microsoft Security Blog
- Evil Evolution: ClickFix and macOS Infostealers — Sophos Blog
- Why AMOS Matters: The macOS Malware Stealing Data at Scale — Sophos Blog
- Atomic macOS Stealer (AMOS): Reading the C2 Protocol from a PCAP — Pcap AI
- macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT — Netskope
- Reverse Engineering MacSync Stealer & RAT — Huntress
- Unit 42 MacSync Stealer IOCs — Palo Alto Networks
- ClickFix GitHub Themed macOS Infostealer IOCs — brkalbyrk GitHub Gist
- Inside MacSync's Script-Driven Stealer — CloudSEK
- Atomic Stealer: Darktrace Investigation of a Growing macOS Threat — Darktrace
- AMOS Stealer v3 Fully Decrypted — Breakglass Intelligence
- MacSync Infostealer Overview — NTT Security Samurai
- MDR Analysis of AMOS Stealer Campaign — Trend Micro
- Mac.c Stealer Evolves into MacSync — Moonlock
Detection coverage for TL-2026-1894
As of 2026-08-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1894 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1894
10 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.