# Macfinger ClickFix delivers unidentified macOS stealer

Published: 2026-09-25 · Severity: routine
Canonical: https://vorant.io/reports/1a54c6ff-f1ac-5206-b36e-8ecca36a09c6/macfinger-clickfix-delivers-unidentified-macos-stealer

> SANS ISC analyzes a macOS infostealer from the active Macfinger ClickFix campaign, concluding it is distinct from AMOS Stealer despite initial reports.

SANS ISC handler Brad Duncan followed up on the Macfinger ClickFix campaign, examining a fresh macOS infection from September 24, 2026. The campaign uses fake CAPTCHA/verification pages to trick victims into pasting a ClickFix-style command into Terminal, which downloads a shell-script loader. The loader saves an architecture-specific Mach-O binary (arm64 or x86_64) to /Library/Caches/com.apple.securityd/com.apple.periodic, killing any existing process of the same name first, then fetches a persistent copy that installs via a LaunchAgent plist (com.apple.softwareupdated.plist) running a binary named SoftwareUpdate from /Library/Caches/com.apple.softwareupdate/. The malware requests extensive TCC permissions (Notes, Documents, Desktop, Downloads, Photos, Music/media, admin password, Keychain password) before exfiltrating data via HTTP POST to /api/credentials and switching to WebSocket traffic for C2 — a technique the author notes differs notably from AMOS Stealer's behavior.

The analyst argues this malware should not be classified as an AMOS Stealer variant, citing differences in data collection/exfiltration methods, persistence mechanisms, and binary architecture handling (AMOS uses combined arm64/x86_64 installers, whereas this malware uses separate binaries per architecture). The malware remains unnamed pending further community analysis. C2 infrastructure includes 45.131.215[.]56 (payload hosting) and 95.163.153[.]80:8133 (C2 API endpoints for /api/t, /api/credentials, /api/shell/agent), with the ClickFix lure domain hollow-badger-moasfraum[.]life.

Defenders should treat any Terminal paste-and-run prompts from browser "verification" pages as a red flag, and monitor for LaunchAgents named com.apple.softwareupdated.plist, processes named com.apple.periodic or SoftwareUpdate under non-standard Cache directories, and outbound WebSocket/HTTP traffic to the listed IPs. A packet capture and malware samples are available from the source for further analysis and detection engineering.

## Mentioned in this report

- Malware: Macfinger ClickFix Stealer
- Campaigns: Macfinger ClickFix

## Detection guidance (public sample)

### Suspicious Binary Execution from Cache Directories

ATT&CK: T1036.005

Detects execution of binaries from /Library/Caches subdirectories with names matching legitimate system processes (SoftwareUpdate, com.apple.periodic), typical of malware masquerading as system utilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Binary Execution from Cache Directories
description: Detects execution of binaries named SoftwareUpdate or com.apple.periodic
  from /Library/Caches paths - malware persistence using name spoofing and non-standard
  locations.
tags:
- attack.execution
- attack.t1036.005
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|contains: /Library/Caches/
    Image|endswith:
    - /SoftwareUpdate
    - /com.apple.periodic
  filter_legitimate_cache:
    Image|contains: /Library/Caches/com.apple.nsurlsessiond/
  condition: selection and not filter_legitimate_cache
falsepositives:
- Legitimate macOS updater frameworks caching binaries
- Apple internal tools using com.apple.* namespaced executables in cache
level: high
id: 071895dd-9158-5cd3-9b46-460a37e199c6
status: experimental
author: Vorant
```

### Process Termination Before Binary Replacement in Cache

ATT&CK: T1036.005

Detects a process killing followed by file write to /Library/Caches with architecture-specific binary names (com.apple.periodic, SoftwareUpdate), indicating staged malware installation with name spoofing. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Process Termination Before Binary Replacement in Cache
description: Detects kill/termination of a process immediately followed by file write
  to /Library/Caches with spoofed system binary names - characteristic of malware
  staging.
tags:
- attack.execution
- attack.t1036.005
- attack.persistence
logsource:
  category: process_creation
  product: macos
detection:
  selection_kill:
    CommandLine|contains:
    - com.apple.periodic
    - SoftwareUpdate
  condition: selection_kill
falsepositives:
- Legitimate software update frameworks cleanly replacing cached binaries
- Package managers with permission to cache and restart services
level: medium
id: 336c2f20-43b0-5295-860a-1d6e151e5d4c
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

4 more detections for this report are in the app: the rules that match its indicators, every rule converted to Splunk SPL, Microsoft KQL and Elastic, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://isc.sans.edu/diary/rss/33368

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1a54c6ff-f1ac-5206-b36e-8ecca36a09c6/macfinger-clickfix-delivers-unidentified-macos-stealer.
In the app the same report carries its extracted indicators, its detections with Splunk SPL and Microsoft KQL already written, live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup