Macfinger ClickFix campaign targets macOS with AMOS variant

A ClickFix social-engineering campaign injects fake bot-verification pages into legitimate sites to trick macOS users into running a shell script that deploys an AMOS Stealer variant.

SANS ISC researcher Bradley Duncan documented a ClickFix campaign, dubbed "Macfinger," that compromises legitimate websites with injected JavaScript to display a fake bot-protection/verification page. The page instructs macOS victims to copy and run a command (the classic ClickFix technique), which downloads a Bash shell script from 45.150.33[.]128. That script retrieves architecture-specific Mach-O payloads (arm64 and x86_64) identified by the reporting community as a variant of Atomic macOS Stealer (AMOS), though Duncan notes the indicators differ from AMOS activity he has previously tracked, suggesting a distinct build or fork.

Once executed, the malware beacons to a C2 server at 95.163.153[.]80 over TCP port 8133, sending frequent telemetry (/api/t), harvesting and exfiltrating credentials (/api/credentials), and supporting remote shell access (/api/shell/agent). The injected script and fake verification page also send tracking POST requests to the attacker-controlled domain velvet-otter-glagceis[.]life even before the victim executes anything, suggesting fingerprinting of visitors. The campaign appears to specifically target macOS hosts and was independently reported by the Ransom-ISAC Blog earlier in the month, though it lacked a public name until now.

Defenders should treat any ClickFix-style "verification" prompt asking users to paste and execute a terminal command as malicious, particularly on macOS endpoints. Network defenders should monitor for connections to the listed domain/IPs and unusual outbound traffic to non-standard high ports (8133) carrying credential-like POST data. Microsoft's ClickFix mitigation guidance is referenced for broader protection strategies.

title: Bash Script Execution from Suspicious Download Sources
description: Detects bash or sh processes executing remotely fetched scripts via curl/wget
  redirection or piping - characteristic of ClickFix malware delivery where victims
  copy-paste a command that downloads and executes a shell script. This rule targets
  the parent/child pattern and pipe-to-shell syntax, not specific URLs.
tags:
- attack.execution
- attack.t1204.004
logsource:
  category: process_creation
  product: macos
detection:
  selection_bash_pipe:
    Image|endswith:
    - /bin/bash
    - /bin/sh
    ParentCommandLine|contains:
    - '| bash'
    - '| sh'
    - '| /bin/bash'
    - '| /bin/sh'
  selection_curl_wget:
    Image|endswith:
    - /usr/bin/curl
    - /usr/bin/wget
    CommandLine|contains:
    - -o /tmp/
    - -o /var/tmp/
    - '| bash'
    - '| sh'
  filter_legitimate_admin:
    User|startswith:
    - _
    - root
  condition: (selection_bash_pipe or selection_curl_wget) and not filter_legitimate_admin
falsepositives:
- Legitimate software installation scripts from trusted sources
- System administration tools downloading and executing approved scripts
level: high
id: efb0b14e-1c84-5295-8faf-9b5c2b11af3e
status: experimental
author: Vorant

title: Process Execution Harvesting System and Credential Information
description: Detects suspicious combinations of system information discovery (uname,
  system_profiler, arch) and credential extraction (security find-generic-password,
  launchctl) executed in sequence - characteristic of AMOS stealer and similar credential
  harvesters that enumerate the system before exfiltration.
tags:
- attack.discovery
- attack.credential-access
- attack.t1082
- attack.t1555
logsource:
  category: process_creation
  product: macos
detection:
  selection_arch_enum:
    Image|endswith:
    - /usr/bin/uname
    - /usr/sbin/system_profiler
    - /usr/bin/arch
  selection_cred_extract:
    Image|endswith:
    - /usr/bin/security
    CommandLine|contains:
    - find-generic-password
    - find-internet-password
  selection_launch_enum:
    Image|endswith: /bin/launchctl
    CommandLine|contains:
    - list
    - getenv
  filter_admin_context:
    User|startswith:
    - _
    - root
  condition: (selection_arch_enum or selection_cred_extract or selection_launch_enum)
    and not filter_admin_context
falsepositives:
- Legitimate system administration tools performing inventory or compliance checks
- Educational software or security research tools
level: medium
id: 4cfb18a7-3b47-503d-8335-dbdfb51d61a9
status: experimental
author: Vorant

title: Outbound Connection to Non-Standard High Port with POST Data
description: Detects suspicious outbound TCP connections to non-standard high ports
  (typically 8000+) from user processes, characteristic of malware C2 communication
  beaconing and data exfiltration. Generalises on the port range and POST pattern,
  not specific attacker infrastructure.
tags:
- attack.command-and-control
- attack.exfiltration
- attack.t1071.001
logsource:
  category: network_connection
  product: macos
detection:
  selection:
    DestinationPort|gte: 8000
    DestinationPort|lt: 65535
    Protocol: tcp
    User|startswith:
    - /Users/
  filter_known_services:
    Image|endswith:
    - /Applications/Slack.app/Contents/MacOS/Slack
    - /Applications/Discord.app/Contents/MacOS/Discord
    - /Applications/Spotify.app/Contents/MacOS/Spotify
    - /opt/homebrew/bin/node
  condition: selection and not filter_known_services
falsepositives:
- Development environments and local testing on high ports
- Cloud synchronization and VPN client software using non-standard ports
level: medium
id: cc012969-82dd-5273-ab4d-5053833929ea
status: experimental
author: Vorant

Source reporting: https://isc.sans.edu/diary/rss/33360