# Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (AMOS) via Fake Verification Prompts

> SANS ISC handler Brad Duncan documents "Macfinger," a ClickFix-style social engineering campaign that compromises legitimate websites to display fake bot/security verification prompts, tricking macOS users into pasting and running shell commands in Terminal. The commands fingerprint the Mac's CPU architecture and fetch a matching ARM64 or x86_64 Mach-O binary — a variant of Atomic macOS Stealer (AMOS) that harvests Keychain and browser credentials, cryptocurrency wallet data, and system information, exfiltrating it to a dedicated C2 server.

- **Published:** 2026-09-23T00:00:00Z
- **Last reviewed:** 2026-09-28T00:10:59.829Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2622
- **ID:** TL-2026-2622
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Macfinger is a macOS-targeted ClickFix campaign first observed by SANS Internet Storm Center handler Brad Duncan on 2026-09-21 and published 2026-09-23. Attackers inject malicious JavaScript into compromised, otherwise-legitimate websites; visiting the page triggers a fake bot/human-verification overlay (a spoofed Cloudflare Turnstile/CAPTCHA-style prompt) that instructs the visitor to copy a command and paste it into the macOS Terminal to 'prove' they are human. This is the ClickFix technique (MITRE T1204.004, User Execution: Malicious Copy and Paste), which has moved from its original Windows Run-dialog/PowerShell form into macOS Terminal abuse over the past year.

The injected page first loads tracking/staging JavaScript from the attacker-registered domain velvet-otter-glagceis.life (t.js, ext-b.*.js) and posts telemetry to its /collect endpoint. The pasted Terminal command retrieves a 4,674-byte Bourne-Again shell script from the malware-hosting IP 45.150.33.128, which performs architecture fingerprinting (ARM64 vs. x86_64) and force-downloads the matching Mach-O executable from the same host (paths such as /92961f75b259df2?force=1). Both observed payloads — a 33.3MB arm64 binary and a 34.1MB x86_64 binary — are variants of Atomic macOS Stealer (AMOS), a subscription malware-as-a-service infostealer that has been the dominant macOS threat family through 2025-2026, historically distributed via fake cracked-software installers and, increasingly, ClickFix lures.

Once executed, the AMOS variant beacons to a dedicated C2 server at 95.163.153.80 on TCP port 8133, using distinct REST-style endpoints: /api/t (telemetry/check-in), /api/shell/agent (remote command execution capability), and /api/credentials (credential exfiltration). AMOS's standard behavior — consistent with prior AMOS reporting, including SANS ISC diary #33208 (2026-08-02, campaign via getmacouscloud[.]com) and Microsoft's macOS ClickFix writeups (2026-05-06, 2026-08-05) — includes prompting the user for their macOS login password to access Keychain, extracting stored browser credentials and cookies, and targeting cryptocurrency wallet application data (Electrum, Exodus, Binance, Coinomi, Atomic). The malware also queries ipinfo.io, a pattern consistent with victim geolocation/targeting checks seen across the AMOS family. No CVE applies: the entire chain is social-engineering-driven execution of attacker-supplied shell commands and a downloaded binary, not exploitation of a software vulnerability.

## MITRE ATT&CK

- T1584.004 Server
- T1608.004 Drive-by Target
- T1583.001 Domains
- T1587.001 Malware
- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1190 Exploit Public-Facing Application
- T1543.001 Launch Agent
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Name or Location
- T1553.001 Gatekeeper Bypass
- T1070.003 Clear Command History
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Macfinger ClickFix campaign](https://isc.sans.edu/forums/diary/Macfinger+ClickFix+campaign/33360/)
- [SANS ISC Diary #33208 — AMOS Stealer ClickFix campaign (getmacouscloud.com)](https://isc.sans.edu/diary/33208)
- [Think before you Click(Fix): Analyzing the ClickFix social engineering technique](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide](https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/)
- [Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/)
- [Why AMOS matters: The macOS malware stealing data at scale](https://www.sophos.com/en-us/blog/why-amos-matters-the-macos-malware-stealing-data-at-scale)
- [Atomic Stealer: Dissecting 2024's Most Notorious macOS Infostealer](https://www.picussecurity.com/resource/blog/atomic-stealer-amos-macos-threat-analysis)
- [AMOS Variant Distributed Via ClickFix in Spectrum-Themed Dynamic Delivery Campaign by Russian Speaking Hackers](https://www.cloudsek.com/blog/amos-variant-distributed-via-clickfix-in-spectrum-themed-dynamic-delivery-campaign-by-russian-speaking-hackers)
- [ClickFix Campaign Uses Fake macOS Utilities to Deliver Infostealers](https://rhisac.org/threat-intelligence/clickfix-campaign-uses-fake-macos-utilities-to-deliver-infostealers/)
- [macOS ClickFix Campaign Delivers AMOS and Other Infostealers: A DNS Deep Dive](https://circleid.com/posts/macos-clickfix-campaign-delivers-amos-and-other-infostealers-a-dns-deep-dive)
- [ClickFix Hits macOS via AI Tools: Real Attack Analyzed](https://any.run/cybersecurity-blog/macos-clickfix-amos-attack/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2622