Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (AMOS) via Fake Verification Prompts

Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (TL-2026-2622), also tracked as Macfinger, is a high-severity malware campaign, first published 2026-09-23. It has no confirmed attribution, affects Apple macOS, maps to 13 MITRE ATT&CK techniques (T1005, T1059.004, T1071.001), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-2622

Threat ID
TL-2026-2622
Also known as
Macfinger
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-09-23
Last reviewed
2026-09-23
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
general public
Target regions
Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in Macfinger ClickFix Campaign Delivers Atomic macOS Stealer

Malware and tooling: AMOS

SANS ISC handler Brad Duncan documents "Macfinger," a ClickFix-style social engineering campaign that compromises legitimate websites to display fake bot/security verification prompts, tricking macOS users into pasting and running shell commands in Terminal. The commands fingerprint the Mac's CPU architecture and fetch a matching ARM64 or x86_64 Mach-O binary — a variant of Atomic macOS Stealer (AMOS) that harvests Keychain and browser credentials, cryptocurrency wallet data, and system information, exfiltrating it to a dedicated C2 server.

How Macfinger ClickFix Campaign Delivers Atomic macOS Stealer works

Macfinger is a macOS-targeted ClickFix campaign first observed by SANS Internet Storm Center handler Brad Duncan on 2026-09-21 and published 2026-09-23. Attackers inject malicious JavaScript into compromised, otherwise-legitimate websites; visiting the page triggers a fake bot/human-verification overlay (a spoofed Cloudflare Turnstile/CAPTCHA-style prompt) that instructs the visitor to copy a command and paste it into the macOS Terminal to 'prove' they are human. This is the ClickFix technique (MITRE T1204.004, User Execution: Malicious Copy and Paste), which has moved from its original Windows Run-dialog/PowerShell form into macOS Terminal abuse over the past year.

The injected page first loads tracking/staging JavaScript from the attacker-registered domain velvet-otter-glagceis.life (t.js, ext-b.*.js) and posts telemetry to its /collect endpoint. The pasted Terminal command retrieves a 4,674-byte Bourne-Again shell script from the malware-hosting IP 45.150.33.128, which performs architecture fingerprinting (ARM64 vs. x86_64) and force-downloads the matching Mach-O executable from the same host (paths such as /92961f75b259df2?force=1). Both observed payloads — a 33.3MB arm64 binary and a 34.1MB x86_64 binary — are variants of Atomic macOS Stealer (AMOS), a subscription malware-as-a-service infostealer that has been the dominant macOS threat family through 2025-2026, historically distributed via fake cracked-software installers and, increasingly, ClickFix lures.

Once executed, the AMOS variant beacons to a dedicated C2 server at 95.163.153.80 on TCP port 8133, using distinct REST-style endpoints: /api/t (telemetry/check-in), /api/shell/agent (remote command execution capability), and /api/credentials (credential exfiltration). AMOS's standard behavior — consistent with prior AMOS reporting, including SANS ISC diary #33208 (2026-08-02, campaign via getmacouscloud[.]com) and Microsoft's macOS ClickFix writeups (2026-05-06, 2026-08-05) — includes prompting the user for their macOS login password to access Keychain, extracting stored browser credentials and cookies, and targeting cryptocurrency wallet application data (Electrum, Exodus, Binance, Coinomi, Atomic). The malware also queries ipinfo.io, a pattern consistent with victim geolocation/targeting checks seen across the AMOS family. No CVE applies: the entire chain is social-engineering-driven execution of attacker-supplied shell commands and a downloaded binary, not exploitation of a software vulnerability.

MITRE ATT&CK techniques used in TL-2026-2622

Collection

T1005 Data from Local System

Execution

T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols

Discovery

T1082 System Information Discovery; T1614 System Location Discovery

Credential Access

T1552.001 Credentials In Files; T1555.001 Keychain; T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains; T1584.004 Server; T1587.001 Malware; T1608.004 Drive-by Target

Affected products and versions in Macfinger ClickFix Campaign Delivers Atomic macOS Stealer

  • Apple — macOS
    Vulnerable versions: All current macOS releases on Apple Silicon (ARM64) and Intel (x86_64) Macs

Remediation for Macfinger ClickFix Campaign Delivers Atomic macOS Stealer

Patches

  • No vendor patch applicable — delivery is social-engineering-driven command execution, not exploitation of a software vulnerability

Immediate actions

  • Block network traffic to velvet-otter-glagceis.life, 45.150.33.128, and 95.163.153.80:8133 at DNS/firewall/proxy
  • Hunt endpoint and proxy logs for the listed URLs and SHA-256 hashes
  • Isolate and forensically image any macOS host observed executing the identified bash script or Mach-O binaries
  • Force-rotate Keychain-stored and browser-saved credentials, and move cryptocurrency wallet funds, on any confirmed-infected host

Workarounds

  • Disable clipboard auto-paste/quick actions where policy allows
  • Restrict Terminal.app execution via macOS Gatekeeper/endpoint policy for non-technical user populations

Longer-term hardening

  • Deploy EDR with macOS behavioral detection for Terminal.app/osascript spawning curl/bash from clipboard-pasted commands
  • Enforce browser and OS-level protections against clipboard-to-terminal social engineering (ClickFix)
  • User awareness training specifically covering fake CAPTCHA/bot-verification 'paste this into Terminal' prompts
  • Monitor for injected/anomalous JavaScript on owned web properties to prevent becoming an unwitting Macfinger distribution node

Timeline of Macfinger ClickFix Campaign Delivers Atomic macOS Stealer

  • macOS ClickFix delivery first observed as an emerging vector, expanding the technique beyond its original Windows Run-dialog/PowerShell form.
  • Microsoft publishes 'Think before you Click(Fix)' analyzing the ClickFix social engineering technique across Windows and macOS.
  • Microsoft documents a macOS ClickFix campaign using fake utility lures to deliver the Macsync, Shub Stealer, and AMOS infostealers.
  • SANS ISC diary #33208 documents a related AMOS Stealer ClickFix campaign distributed via getmacouscloud[.]com, render65[.]com, and grove-89[.]com, C2 at 188.166.78.138.
  • Microsoft reports the macOS ClickFix campaign evolving to a server-side browser-fingerprinting gate that shows the lure only to apparent genuine macOS visitors.
  • SANS ISC handler Brad Duncan begins initial testing/observation of the Macfinger campaign infrastructure and payloads.
  • Macfinger ClickFix campaign observed compromising legitimate websites to serve fake bot/security verification prompts delivering AMOS to macOS users.
  • SANS ISC publishes diary #33360, 'Macfinger ClickFix campaign,' documenting the full IOC set and attack chain.

Sources cited for Macfinger ClickFix Campaign Delivers Atomic macOS Stealer

More in malware

Detection coverage for TL-2026-2622

As of 2026-09-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2622 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats