Skip to navigation

Threat reportMalwareTL-2026-2622

Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (AMOS) via Fake Verification Prompts

highACTIVE

SANS ISC handler Brad Duncan documents "Macfinger," a ClickFix-style social engineering campaign that compromises legitimate websites to display fake bot/security verification prompts, tricking macOS users into pasting and running shell commands in Terminal. The commands fingerprint the Mac's CPU architecture and fetch a matching ARM64 or x86_64 Mach-O binary — a variant of Atomic macOS Stealer (AMOS) that harvests Keychain and browser credentials, cryptocurrency wallet data, and system information, exfiltrating it to a dedicated C2 server.

Key facts

IdentifiersTL-2026-2622
Also known asMacfinger
SeverityHIGH
Affected productsApple macOS
MalwareAMOS
MITRE ATT&CK techniquesT1005 Data from Local System, T1027 Obfuscated Files or Information, T1036.005 Match Legitimate Name or Location, T1041 Exfiltration Over C2 Channel, T1059.004 Unix Shell, T1070.003 Clear Command History, T1071.001 Web Protocols, T1082 System Information Discovery, T1105 Ingress Tool Transfer, T1190 Exploit Public-Facing Application, T1204.004 Malicious Copy and Paste, T1543.001 Launch Agent and 9 more in the attack flow
MotivationFINANCIAL
Target sectorsgeneral public
Target regionsGlobal
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage

As of 2026-09-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2622 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AMOS Stealer C2 Beacon and Credential Exfiltration to Macfinger Infrastructure

Detects outbound C2 beaconing and credential exfiltration from an infected macOS host to the dedicated Macfinger AMOS C2 server (95.163.153.80:8133) via its /api/t (check-in), /api/shell/agent (remote shell tasking), and /api/credentials (exfil) REST endpoints, or to the TL_OSINT_Scan community-corroborated sibling domain shopguoerve.pro.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1071.001, T1614, T1608.004
  • Data sources: proxy_web_logs, firewall_netflow, dns_logs
  • Severity: critical
  • Confidence: high

Splunk SPL

index=proxy OR index=firewall sourcetype IN ("stream:http","pan:threat","squid_access") earliest=-24h
    ((dest_ip="95.163.153.80" AND dest_port=8133) OR uri_path IN ("/api/t","/api/shell/agent","/api/credentials") OR dest_host="shopguoerve.pro")
| eval c2_stage=case(
    uri_path="/api/t", "checkin_telemetry",
    uri_path="/api/shell/agent", "remote_shell_c2",
    uri_path="/api/credentials", "credential_exfil",
    dest_host="shopguoerve.pro", "community_sibling_infra",
    1=1, "unknown_c2_stage")
| stats earliest(_time) as first_seen, latest(_time) as last_seen, count, values(http_method) as methods by src_ip, dest_ip, dest_port, dest_host, uri_path, c2_stage
| where count > 0

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where (RemoteIP == "95.163.153.80" and RemotePort == 8133)
    or RemoteUrl has_any ("/api/t", "/api/shell/agent", "/api/credentials")
    or RemoteUrl has "shopguoerve.pro"
| extend C2Stage = case(
    RemoteUrl has "/api/shell/agent", "remote_shell_c2",
    RemoteUrl has "/api/credentials", "credential_exfil",
    RemoteUrl has "/api/t", "checkin_telemetry",
    "watchlist_domain")
| summarize BeaconCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, C2Stage
| where BeaconCount >= 1

Sigma

title: AMOS Stealer C2 Beacon or Credential Exfiltration to Macfinger Infrastructure
id: e91a7c4f-2d5b-46a8-b3e9-6f4c8a1d7b02
status: experimental
description: Detects outbound network connections from a macOS host to the Macfinger/AMOS Stealer C2 server (95.163.153.80:8133) REST endpoints used for check-in, remote shell tasking, and credential exfiltration, or to community-observed sibling infrastructure (shopguoerve.pro).
references:
    - https://isc.sans.edu/forums/diary/Macfinger+ClickFix+campaign/33360/
author: Threadlinqs Team
date: 2026-09-23
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.discovery
    - attack.t1614
    - attack.resource-development
    - attack.t1608.004
    - attack.tool.amos_stealer
logsource:
    category: network_connection
    product: macos
detection:
    selection_ip:
        DestinationIp: '95.163.153.80'
        DestinationPort: 8133
    selection_url:
        DestinationHostname|contains:
            - 'shopguoerve.pro'
    condition: selection_ip or selection_url
falsepositives:
    - None expected — destination IP/port and hostname are dedicated attacker infrastructure with no known legitimate use
level: critical

Known false positives:

  • None expected for the dedicated C2 IP:port pair; shopguoerve.pro is community-observed sibling infrastructure, so corroborate with a preceding Row-1/Row-2 host detection before high-severity escalation

Tuning notes: Treat 95.163.153.80:8133 hits as high-confidence/critical since it is dedicated attacker infrastructure. Treat shopguoerve.pro hits as medium-confidence pending additional corroboration, since it originates from community OSINT (TL_OSINT_Scan / tweetfeed) rather than direct first-party observation. Add ipinfo.io geolocation lookups as a low-weight supporting signal only when chained with a Row-1 or Row-2 detection on the same host, since ipinfo.io alone has many legitimate uses.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Macfinger ClickFix Terminal Paste-and-Execute — AMOS Downloader · unlock with TL Creds
  • AMOS Stealer Keychain, Browser Credential & Crypto Wallet Harvesting · unlock with TL Creds
  • AMOS Stealer C2 Beacon and Credential Exfiltration to Macfinger Infrastructure · unlock with TL Creds
  • Macfinger ClickFix Terminal Paste-and-Execute — AMOS Downloader · unlock with TL Creds
  • AMOS Stealer Keychain, Browser Credential & Crypto Wallet Harvesting · unlock with TL Creds
  • AMOS Stealer C2 Beacon and Credential Exfiltration to Macfinger Infrastructure · unlock with TL Creds
  • Macfinger ClickFix Terminal Paste-and-Execute — AMOS Downloader · unlock with TL Creds
  • AMOS Stealer Keychain, Browser Credential & Crypto Wallet Harvesting · unlock with TL Creds

Indicators of compromise

As of 2026-09-28, Threadlinqs Intelligence tracks 39 indicators of compromise for TL-2026-2622.

Sample indicators (3 of 39)

  • IP address: 45.150.33[.]128
  • Domain: velvet-otter-glagceis[.]life
  • File hash: 6606a5f18184b224a56c9cb658fa26f7fce45099da548a30a8db2c5f2c70377c

Defanged, TLP:CLEAR. Full set of 39 indicators: unlock with TL Creds.

39 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Macfinger is a macOS-targeted ClickFix campaign first observed by SANS Internet Storm Center handler Brad Duncan on 2026-09-21 and published 2026-09-23. Attackers inject malicious JavaScript into compromised, otherwise-legitimate websites; visiting the page triggers a fake bot/human-verification overlay (a spoofed Cloudflare Turnstile/CAPTCHA-style prompt) that instructs the visitor to copy a command and paste it into the macOS Terminal to 'prove' they are human. This is the ClickFix technique (MITRE T1204.004, User Execution: Malicious Copy and Paste), which has moved from its original Windows Run-dialog/PowerShell form into macOS Terminal abuse over the past year.

The injected page first loads tracking/staging JavaScript from the attacker-registered domain velvet-otter-glagceis.life (t.js, ext-b.*.js) and posts telemetry to its /collect endpoint. The pasted Terminal command retrieves a 4,674-byte Bourne-Again shell script from the malware-hosting IP 45.150.33.128, which performs architecture fingerprinting (ARM64 vs. x86_64) and force-downloads the matching Mach-O executable from the same host (paths such as /92961f75b259df2?force=1). Both observed payloads — a 33.3MB arm64 binary and a 34.1MB x86_64 binary — are variants of Atomic macOS Stealer (AMOS), a subscription malware-as-a-service infostealer that has been the dominant macOS threat family through 2025-2026, historically distributed via fake cracked-software installers and, increasingly, ClickFix lures.

Once executed, the AMOS variant beacons to a dedicated C2 server at 95.163.153.80 on TCP port 8133, using distinct REST-style endpoints: /api/t (telemetry/check-in), /api/shell/agent (remote command execution capability), and /api/credentials (credential exfiltration). AMOS's standard behavior — consistent with prior AMOS reporting, including SANS ISC diary #33208 (2026-08-02, campaign via getmacouscloud[.]com) and Microsoft's macOS ClickFix writeups (2026-05-06, 2026-08-05) — includes prompting the user for their macOS login password to access Keychain, extracting stored browser credentials and cookies, and targeting cryptocurrency wallet application data (Electrum, Exodus, Binance, Coinomi, Atomic). The malware also queries ipinfo.io, a pattern consistent with victim geolocation/targeting checks seen across the AMOS family. No CVE applies: the entire chain is social-engineering-driven execution of attacker-supplied shell commands and a downloaded binary, not exploitation of a software vulnerability.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Name or Location; T1070.003 Clear Command History; T1553.001 Gatekeeper Bypass

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1614 System Location Discovery

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1543.001 Launch Agent

Credential Access

T1552.001 Credentials In Files; T1555.001 Keychain; T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains; T1584.004 Server; T1587.001 Malware; T1608.004 Drive-by Target

Remediation

Patches

  • No vendor patch applicable — delivery is social-engineering-driven command execution, not exploitation of a software vulnerability

Immediate actions

  • Block network traffic to velvet-otter-glagceis.life, 45.150.33.128, and 95.163.153.80:8133 at DNS/firewall/proxy
  • Hunt endpoint and proxy logs for the listed URLs and SHA-256 hashes
  • Isolate and forensically image any macOS host observed executing the identified bash script or Mach-O binaries
  • Force-rotate Keychain-stored and browser-saved credentials, and move cryptocurrency wallet funds, on any confirmed-infected host

Workarounds

  • Disable clipboard auto-paste/quick actions where policy allows
  • Restrict Terminal.app execution via macOS Gatekeeper/endpoint policy for non-technical user populations

Longer-term hardening

  • Deploy EDR with macOS behavioral detection for Terminal.app/osascript spawning curl/bash from clipboard-pasted commands
  • Enforce browser and OS-level protections against clipboard-to-terminal social engineering (ClickFix)
  • User awareness training specifically covering fake CAPTCHA/bot-verification 'paste this into Terminal' prompts
  • Monitor for injected/anomalous JavaScript on owned web properties to prevent becoming an unwitting Macfinger distribution node

Affected and fixed versions

  • Apple — macOS
    Vulnerable versions: All current macOS releases on Apple Silicon (ARM64) and Intel (x86_64) Macs

Timeline

Last updated · revalidated 1× · latest source

  • macOS ClickFix delivery first observed as an emerging vector, expanding the technique beyond its original Windows Run-dialog/PowerShell form.
  • Microsoft publishes 'Think before you Click(Fix)' analyzing the ClickFix social engineering technique across Windows and macOS.
  • Microsoft documents a macOS ClickFix campaign using fake utility lures to deliver the Macsync, Shub Stealer, and AMOS infostealers.
  • Ransom-ISAC's independent tracking window begins: earliest observed compromised WordPress sites serving the Macfinger ClickFix fake reCAPTCHA lure.
  • SANS ISC diary #33208 documents a related AMOS Stealer ClickFix campaign distributed via getmacouscloud[.]com, render65[.]com, and grove-89[.]com, C2 at 188.166.78.138.
  • Microsoft reports the macOS ClickFix campaign evolving to a server-side browser-fingerprinting gate that shows the lure only to apparent genuine macOS visitors.
  • Ransom-ISAC closes its 7-week tracking window having observed 1,650+ distinct infected websites, 154 cumulative C2 domains, and infection-acceptance rates rising from 20-34% to 37-39%.
  • Ransom-ISAC reports 120 of 121 resolvable C2 hostnames route through sanctioned hosting providers AS210644 (Aeza Group LLC) and AS203273 (NetCrafters OU).
  • SANS ISC handler Brad Duncan begins initial testing/observation of the Macfinger campaign infrastructure and payloads.
  • Macfinger ClickFix campaign observed compromising legitimate websites to serve fake bot/security verification prompts delivering AMOS to macOS users.
  • SANS ISC publishes diary #33360, 'Macfinger ClickFix campaign,' documenting the full IOC set and attack chain.
  • Brad Duncan analyzes a fresh macOS infection from the campaign on a macOS 27.0 ('Golden Gate') host, capturing the loader script, C2 traffic, and persistence artifacts (LaunchAgent plist, staged binaries).
  • SANS ISC diary #33368 is published, reclassifying the delivered malware as a distinct family (not AMOS) based on differing persistence, single-architecture Mach-O packaging, and WebSocket-based C2.

Update history

Sources cited

Previous and next in malware

Further reading

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats