Macfinger ClickFix delivers unidentified macOS stealer
SANS ISC analyzes a macOS infostealer from the active Macfinger ClickFix campaign, concluding it is distinct from AMOS Stealer despite initial reports.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
SANS ISC handler Brad Duncan followed up on the Macfinger ClickFix campaign, examining a fresh macOS infection from September 24, 2026. The campaign uses fake CAPTCHA/verification pages to trick victims into pasting a ClickFix-style command into Terminal, which downloads a shell-script loader. The loader saves an architecture-specific Mach-O binary (arm64 or x86_64) to /Library/Caches/com.apple.securityd/com.apple.periodic, killing any existing process of the same name first, then fetches a persistent copy that installs via a LaunchAgent plist (com.apple.softwareupdated.plist) running a binary named SoftwareUpdate from /Library/Caches/com.apple.softwareupdate/. The malware requests extensive TCC permissions (Notes, Documents, Desktop, Downloads, Photos, Music/media, admin password, Keychain password) before exfiltrating data via HTTP POST to /api/credentials and switching to WebSocket traffic for C2 — a technique the author notes differs notably from AMOS Stealer's behavior.
The analyst argues this malware should not be classified as an AMOS Stealer variant, citing differences in data collection/exfiltration methods, persistence mechanisms, and binary architecture handling (AMOS uses combined arm64/x86_64 installers, whereas this malware uses separate binaries per architecture). The malware remains unnamed pending further community analysis. C2 infrastructure includes 45.131.215[.]56 (payload hosting) and 95.163.153[.]80:8133 (C2 API endpoints for /api/t, /api/credentials, /api/shell/agent), with the ClickFix lure domain hollow-badger-moasfraum[.]life.
Defenders should treat any Terminal paste-and-run prompts from browser "verification" pages as a red flag, and monitor for LaunchAgents named com.apple.softwareupdated.plist, processes named com.apple.periodic or SoftwareUpdate under non-standard Cache directories, and outbound WebSocket/HTTP traffic to the listed IPs. A packet capture and malware samples are available from the source for further analysis and detection engineering.
Mentioned in this report
Detection guidance
Suspicious Binary Execution from Cache Directories
A behavioural hunt for the technique in general.
Detects execution of binaries from /Library/Caches subdirectories with names matching legitimate system processes (SoftwareUpdate, com.apple.periodic), typical of malware masquerading as system utilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Binary Execution from Cache Directories
description: Detects execution of binaries named SoftwareUpdate or com.apple.periodic
from /Library/Caches paths - malware persistence using name spoofing and non-standard
locations.
tags:
- attack.execution
- attack.t1036.005
logsource:
category: process_creation
product: macos
detection:
selection:
Image|contains: /Library/Caches/
Image|endswith:
- /SoftwareUpdate
- /com.apple.periodic
filter_legitimate_cache:
Image|contains: /Library/Caches/com.apple.nsurlsessiond/
condition: selection and not filter_legitimate_cache
falsepositives:
- Legitimate macOS updater frameworks caching binaries
- Apple internal tools using com.apple.* namespaced executables in cache
level: high
id: 071895dd-9158-5cd3-9b46-460a37e199c6
status: experimental
author: Vorant
Process Termination Before Binary Replacement in Cache
A behavioural hunt for the technique in general.
Detects a process killing followed by file write to /Library/Caches with architecture-specific binary names (com.apple.periodic, SoftwareUpdate), indicating staged malware installation with name spoofing. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Termination Before Binary Replacement in Cache
description: Detects kill/termination of a process immediately followed by file write
to /Library/Caches with spoofed system binary names - characteristic of malware
staging.
tags:
- attack.execution
- attack.t1036.005
- attack.persistence
logsource:
category: process_creation
product: macos
detection:
selection_kill:
CommandLine|contains:
- com.apple.periodic
- SoftwareUpdate
condition: selection_kill
falsepositives:
- Legitimate software update frameworks cleanly replacing cached binaries
- Package managers with permission to cache and restart services
level: medium
id: 336c2f20-43b0-5295-860a-1d6e151e5d4c
status: experimental
author: Vorant
4 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33368
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs