Macfinger ClickFix campaign targets macOS with AMOS variant
A ClickFix social-engineering campaign injects fake bot-verification pages into legitimate sites to trick macOS users into running a shell script that deploys an AMOS Stealer variant.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
SANS ISC researcher Bradley Duncan documented a ClickFix campaign, dubbed "Macfinger," that compromises legitimate websites with injected JavaScript to display a fake bot-protection/verification page. The page instructs macOS victims to copy and run a command (the classic ClickFix technique), which downloads a Bash shell script from 45.150.33[.]128. That script retrieves architecture-specific Mach-O payloads (arm64 and x86_64) identified by the reporting community as a variant of Atomic macOS Stealer (AMOS), though Duncan notes the indicators differ from AMOS activity he has previously tracked, suggesting a distinct build or fork.
Once executed, the malware beacons to a C2 server at 95.163.153[.]80 over TCP port 8133, sending frequent telemetry (/api/t), harvesting and exfiltrating credentials (/api/credentials), and supporting remote shell access (/api/shell/agent). The injected script and fake verification page also send tracking POST requests to the attacker-controlled domain velvet-otter-glagceis[.]life even before the victim executes anything, suggesting fingerprinting of visitors. The campaign appears to specifically target macOS hosts and was independently reported by the Ransom-ISAC Blog earlier in the month, though it lacked a public name until now.
Defenders should treat any ClickFix-style "verification" prompt asking users to paste and execute a terminal command as malicious, particularly on macOS endpoints. Network defenders should monitor for connections to the listed domain/IPs and unusual outbound traffic to non-standard high ports (8133) carrying credential-like POST data. Microsoft's ClickFix mitigation guidance is referenced for broader protection strategies.
Mentioned in this report
Detection guidance
Bash Script Execution from Suspicious Download Sources
A behavioural hunt for the technique in general.
Detects execution of Bash scripts downloaded from external sources via curl/wget, typical of ClickFix campaigns downloading malicious payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bash Script Execution from Suspicious Download Sources
description: Detects bash or sh processes executing remotely fetched scripts via curl/wget
redirection or piping - characteristic of ClickFix malware delivery where victims
copy-paste a command that downloads and executes a shell script. This rule targets
the parent/child pattern and pipe-to-shell syntax, not specific URLs.
tags:
- attack.execution
- attack.t1204.004
logsource:
category: process_creation
product: macos
detection:
selection_bash_pipe:
Image|endswith:
- /bin/bash
- /bin/sh
ParentCommandLine|contains:
- '| bash'
- '| sh'
- '| /bin/bash'
- '| /bin/sh'
selection_curl_wget:
Image|endswith:
- /usr/bin/curl
- /usr/bin/wget
CommandLine|contains:
- -o /tmp/
- -o /var/tmp/
- '| bash'
- '| sh'
filter_legitimate_admin:
User|startswith:
- _
- root
condition: (selection_bash_pipe or selection_curl_wget) and not filter_legitimate_admin
falsepositives:
- Legitimate software installation scripts from trusted sources
- System administration tools downloading and executing approved scripts
level: high
id: efb0b14e-1c84-5295-8faf-9b5c2b11af3e
status: experimental
author: Vorant
Process Execution Harvesting System and Credential Information
A behavioural hunt for the technique in general.
Detects process execution chains collecting system architecture, user info, and credential access on macOS - AMOS stealer telemetry behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Execution Harvesting System and Credential Information
description: Detects suspicious combinations of system information discovery (uname,
system_profiler, arch) and credential extraction (security find-generic-password,
launchctl) executed in sequence - characteristic of AMOS stealer and similar credential
harvesters that enumerate the system before exfiltration.
tags:
- attack.discovery
- attack.credential-access
- attack.t1082
- attack.t1555
logsource:
category: process_creation
product: macos
detection:
selection_arch_enum:
Image|endswith:
- /usr/bin/uname
- /usr/sbin/system_profiler
- /usr/bin/arch
selection_cred_extract:
Image|endswith:
- /usr/bin/security
CommandLine|contains:
- find-generic-password
- find-internet-password
selection_launch_enum:
Image|endswith: /bin/launchctl
CommandLine|contains:
- list
- getenv
filter_admin_context:
User|startswith:
- _
- root
condition: (selection_arch_enum or selection_cred_extract or selection_launch_enum)
and not filter_admin_context
falsepositives:
- Legitimate system administration tools performing inventory or compliance checks
- Educational software or security research tools
level: medium
id: 4cfb18a7-3b47-503d-8335-dbdfb51d61a9
status: experimental
author: Vorant
4 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33360
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs