Threat reportMalwareTL-2026-2622
Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (AMOS) via Fake Verification Prompts
Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (TL-2026-2622), also tracked as Macfinger, is a high-severity malware campaign, first published 2026-09-23 and last reviewed 2026-09-28. It has no confirmed attribution, affects Apple macOS, maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 39 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 39Indicators of compromise
Key facts for TL-2026-2622
- Threat ID
- TL-2026-2622
- Also known as
- Macfinger
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- general public
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 39
- Updates
- 2026-09-28 · revalidated 1× · latest source
Malware and tooling in Macfinger ClickFix Campaign Delivers Atomic macOS Stealer
Malware and tooling: AMOS
How Macfinger ClickFix Campaign Delivers Atomic macOS Stealer works
SANS ISC handler Brad Duncan documents "Macfinger," a ClickFix-style social engineering campaign that compromises legitimate websites to display fake bot/security verification prompts, tricking macOS users into pasting and running shell commands in Terminal. The commands fingerprint the Mac's CPU architecture and fetch a matching ARM64 or x86_64 Mach-O binary — a variant of Atomic macOS Stealer (AMOS) that harvests Keychain and browser credentials, cryptocurrency wallet data, and system information, exfiltrating it to a dedicated C2 server.
Macfinger is a macOS-targeted ClickFix campaign first observed by SANS Internet Storm Center handler Brad Duncan on 2026-09-21 and published 2026-09-23. Attackers inject malicious JavaScript into compromised, otherwise-legitimate websites; visiting the page triggers a fake bot/human-verification overlay (a spoofed Cloudflare Turnstile/CAPTCHA-style prompt) that instructs the visitor to copy a command and paste it into the macOS Terminal to 'prove' they are human. This is the ClickFix technique (MITRE T1204.004, User Execution: Malicious Copy and Paste), which has moved from its original Windows Run-dialog/PowerShell form into macOS Terminal abuse over the past year.
The injected page first loads tracking/staging JavaScript from the attacker-registered domain velvet-otter-glagceis.life (t.js, ext-b.*.js) and posts telemetry to its /collect endpoint. The pasted Terminal command retrieves a 4,674-byte Bourne-Again shell script from the malware-hosting IP 45.150.33.128, which performs architecture fingerprinting (ARM64 vs. x86_64) and force-downloads the matching Mach-O executable from the same host (paths such as /92961f75b259df2?force=1). Both observed payloads — a 33.3MB arm64 binary and a 34.1MB x86_64 binary — are variants of Atomic macOS Stealer (AMOS), a subscription malware-as-a-service infostealer that has been the dominant macOS threat family through 2025-2026, historically distributed via fake cracked-software installers and, increasingly, ClickFix lures.
Once executed, the AMOS variant beacons to a dedicated C2 server at 95.163.153.80 on TCP port 8133, using distinct REST-style endpoints: /api/t (telemetry/check-in), /api/shell/agent (remote command execution capability), and /api/credentials (credential exfiltration). AMOS's standard behavior — consistent with prior AMOS reporting, including SANS ISC diary #33208 (2026-08-02, campaign via getmacouscloud[.]com) and Microsoft's macOS ClickFix writeups (2026-05-06, 2026-08-05) — includes prompting the user for their macOS login password to access Keychain, extracting stored browser credentials and cookies, and targeting cryptocurrency wallet application data (Electrum, Exodus, Binance, Coinomi, Atomic). The malware also queries ipinfo.io, a pattern consistent with victim geolocation/targeting checks seen across the AMOS family. No CVE applies: the entire chain is social-engineering-driven execution of attacker-supplied shell commands and a downloaded binary, not exploitation of a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-2622
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Name or Location; T1070.003 Clear Command History; T1553.001 Gatekeeper Bypass
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery; T1614 System Location Discovery
Initial Access
T1190 Exploit Public-Facing Application
Persistence
Credential Access
T1552.001 Credentials In Files; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Resource Development
T1583.001 Domains; T1584.004 Server; T1587.001 Malware; T1608.004 Drive-by Target
Affected products and versions in Macfinger ClickFix Campaign Delivers Atomic macOS Stealer
- Apple — macOS
Vulnerable versions: All current macOS releases on Apple Silicon (ARM64) and Intel (x86_64) Macs
Remediation for Macfinger ClickFix Campaign Delivers Atomic macOS Stealer
Patches
- No vendor patch applicable — delivery is social-engineering-driven command execution, not exploitation of a software vulnerability
Immediate actions
- Block network traffic to velvet-otter-glagceis.life, 45.150.33.128, and 95.163.153.80:8133 at DNS/firewall/proxy
- Hunt endpoint and proxy logs for the listed URLs and SHA-256 hashes
- Isolate and forensically image any macOS host observed executing the identified bash script or Mach-O binaries
- Force-rotate Keychain-stored and browser-saved credentials, and move cryptocurrency wallet funds, on any confirmed-infected host
Workarounds
- Disable clipboard auto-paste/quick actions where policy allows
- Restrict Terminal.app execution via macOS Gatekeeper/endpoint policy for non-technical user populations
Longer-term hardening
- Deploy EDR with macOS behavioral detection for Terminal.app/osascript spawning curl/bash from clipboard-pasted commands
- Enforce browser and OS-level protections against clipboard-to-terminal social engineering (ClickFix)
- User awareness training specifically covering fake CAPTCHA/bot-verification 'paste this into Terminal' prompts
- Monitor for injected/anomalous JavaScript on owned web properties to prevent becoming an unwitting Macfinger distribution node
Timeline of Macfinger ClickFix Campaign Delivers Atomic macOS Stealer
- macOS ClickFix delivery first observed as an emerging vector, expanding the technique beyond its original Windows Run-dialog/PowerShell form.
- Microsoft publishes 'Think before you Click(Fix)' analyzing the ClickFix social engineering technique across Windows and macOS.
- Microsoft documents a macOS ClickFix campaign using fake utility lures to deliver the Macsync, Shub Stealer, and AMOS infostealers.
- Ransom-ISAC's independent tracking window begins: earliest observed compromised WordPress sites serving the Macfinger ClickFix fake reCAPTCHA lure.
- SANS ISC diary #33208 documents a related AMOS Stealer ClickFix campaign distributed via getmacouscloud[.]com, render65[.]com, and grove-89[.]com, C2 at 188.166.78.138.
- Microsoft reports the macOS ClickFix campaign evolving to a server-side browser-fingerprinting gate that shows the lure only to apparent genuine macOS visitors.
- Ransom-ISAC closes its 7-week tracking window having observed 1,650+ distinct infected websites, 154 cumulative C2 domains, and infection-acceptance rates rising from 20-34% to 37-39%.
- Ransom-ISAC reports 120 of 121 resolvable C2 hostnames route through sanctioned hosting providers AS210644 (Aeza Group LLC) and AS203273 (NetCrafters OU).
- SANS ISC handler Brad Duncan begins initial testing/observation of the Macfinger campaign infrastructure and payloads.
- Macfinger ClickFix campaign observed compromising legitimate websites to serve fake bot/security verification prompts delivering AMOS to macOS users.
- SANS ISC publishes diary #33360, 'Macfinger ClickFix campaign,' documenting the full IOC set and attack chain.
- Brad Duncan analyzes a fresh macOS infection from the campaign on a macOS 27.0 ('Golden Gate') host, capturing the loader script, C2 traffic, and persistence artifacts (LaunchAgent plist, staged binaries).
- SANS ISC diary #33368 is published, reclassifying the delivered malware as a distinct family (not AMOS) based on differing persistence, single-architecture Mach-O packaging, and WebSocket-based C2.
Update history for TL-2026-2622
- 2026-09-28 — Macfinger ClickFix Campaign Delivers Distinct macOS Infostealer (Not AMOS) With WebSocket C2: What changed SANS ISC diary 33368 (2026-09-25) determined the payload delivered by the Macfinger ClickFix campaign is NOT Atomic macOS Stealer (AMOS) as originally reported in diary 33360 — it is a distinct, still-unnamed macOS infostealer.
Sources cited for Macfinger ClickFix Campaign Delivers Atomic macOS Stealer
- Macfinger ClickFix campaign
- SANS ISC Diary #33208 — AMOS Stealer ClickFix campaign (getmacouscloud[.]com)
- Think before you Click(Fix): Analyzing the ClickFix social engineering technique
- ClickFix campaign uses fake macOS utilities lures to deliver infostealers
- From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
- Atomic macOS (AMOS) Stealer Activity
- Why AMOS matters: The macOS malware stealing data at scale
- Atomic Stealer: Dissecting 2024's Most Notorious macOS Infostealer
- AMOS Variant Distributed Via ClickFix in Spectrum-Themed Dynamic Delivery Campaign by Russian Speaking Hackers
- ClickFix Campaign Uses Fake macOS Utilities to Deliver Infostealers
- macOS ClickFix Campaign Delivers AMOS and Other Infostealers: A DNS Deep Dive
- ClickFix Hits macOS via AI Tools: Real Attack Analyzed
Detection coverage for TL-2026-2622
As of 2026-09-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2622 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.