# Macfinger ClickFix campaign targets macOS with AMOS variant

Published: 2026-09-23 · Severity: routine
Canonical: https://vorant.io/reports/546bef98-f304-588a-be93-df20d5783a4b/macfinger-clickfix-campaign-targets-macos-with-amos-variant

> A ClickFix social-engineering campaign injects fake bot-verification pages into legitimate sites to trick macOS users into running a shell script that deploys an AMOS Stealer variant.

SANS ISC researcher Bradley Duncan documented a ClickFix campaign, dubbed "Macfinger," that compromises legitimate websites with injected JavaScript to display a fake bot-protection/verification page. The page instructs macOS victims to copy and run a command (the classic ClickFix technique), which downloads a Bash shell script from 45.150.33[.]128. That script retrieves architecture-specific Mach-O payloads (arm64 and x86_64) identified by the reporting community as a variant of Atomic macOS Stealer (AMOS), though Duncan notes the indicators differ from AMOS activity he has previously tracked, suggesting a distinct build or fork.

Once executed, the malware beacons to a C2 server at 95.163.153[.]80 over TCP port 8133, sending frequent telemetry (/api/t), harvesting and exfiltrating credentials (/api/credentials), and supporting remote shell access (/api/shell/agent). The injected script and fake verification page also send tracking POST requests to the attacker-controlled domain velvet-otter-glagceis[.]life even before the victim executes anything, suggesting fingerprinting of visitors. The campaign appears to specifically target macOS hosts and was independently reported by the Ransom-ISAC Blog earlier in the month, though it lacked a public name until now.

Defenders should treat any ClickFix-style "verification" prompt asking users to paste and execute a terminal command as malicious, particularly on macOS endpoints. Network defenders should monitor for connections to the listed domain/IPs and unusual outbound traffic to non-standard high ports (8133) carrying credential-like POST data. Microsoft's ClickFix mitigation guidance is referenced for broader protection strategies.

## Mentioned in this report

- Malware: Atomic macOS Stealer (AMOS variant)
- Campaigns: Macfinger ClickFix

## Detection guidance (public sample)

### Bash Script Execution from Suspicious Download Sources

ATT&CK: T1204.004

Detects execution of Bash scripts downloaded from external sources via curl/wget, typical of ClickFix campaigns downloading malicious payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Bash Script Execution from Suspicious Download Sources
description: Detects bash or sh processes executing remotely fetched scripts via curl/wget
  redirection or piping - characteristic of ClickFix malware delivery where victims
  copy-paste a command that downloads and executes a shell script. This rule targets
  the parent/child pattern and pipe-to-shell syntax, not specific URLs.
tags:
- attack.execution
- attack.t1204.004
logsource:
  category: process_creation
  product: macos
detection:
  selection_bash_pipe:
    Image|endswith:
    - /bin/bash
    - /bin/sh
    ParentCommandLine|contains:
    - '| bash'
    - '| sh'
    - '| /bin/bash'
    - '| /bin/sh'
  selection_curl_wget:
    Image|endswith:
    - /usr/bin/curl
    - /usr/bin/wget
    CommandLine|contains:
    - -o /tmp/
    - -o /var/tmp/
    - '| bash'
    - '| sh'
  filter_legitimate_admin:
    User|startswith:
    - _
    - root
  condition: (selection_bash_pipe or selection_curl_wget) and not filter_legitimate_admin
falsepositives:
- Legitimate software installation scripts from trusted sources
- System administration tools downloading and executing approved scripts
level: high
id: efb0b14e-1c84-5295-8faf-9b5c2b11af3e
status: experimental
author: Vorant
```

### Process Execution Harvesting System and Credential Information

ATT&CK: T1082

Detects process execution chains collecting system architecture, user info, and credential access on macOS - AMOS stealer telemetry behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Process Execution Harvesting System and Credential Information
description: Detects suspicious combinations of system information discovery (uname,
  system_profiler, arch) and credential extraction (security find-generic-password,
  launchctl) executed in sequence - characteristic of AMOS stealer and similar credential
  harvesters that enumerate the system before exfiltration.
tags:
- attack.discovery
- attack.credential-access
- attack.t1082
- attack.t1555
logsource:
  category: process_creation
  product: macos
detection:
  selection_arch_enum:
    Image|endswith:
    - /usr/bin/uname
    - /usr/sbin/system_profiler
    - /usr/bin/arch
  selection_cred_extract:
    Image|endswith:
    - /usr/bin/security
    CommandLine|contains:
    - find-generic-password
    - find-internet-password
  selection_launch_enum:
    Image|endswith: /bin/launchctl
    CommandLine|contains:
    - list
    - getenv
  filter_admin_context:
    User|startswith:
    - _
    - root
  condition: (selection_arch_enum or selection_cred_extract or selection_launch_enum)
    and not filter_admin_context
falsepositives:
- Legitimate system administration tools performing inventory or compliance checks
- Educational software or security research tools
level: medium
id: 4cfb18a7-3b47-503d-8335-dbdfb51d61a9
status: experimental
author: Vorant
```

### Outbound Connection to Non-Standard High Port with POST Data

ATT&CK: T1071.001

Detects outbound TCP connections to high ports (8000+) carrying POST requests and credential-like data patterns - C2 beaconing behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound Connection to Non-Standard High Port with POST Data
description: Detects suspicious outbound TCP connections to non-standard high ports
  (typically 8000+) from user processes, characteristic of malware C2 communication
  beaconing and data exfiltration. Generalises on the port range and POST pattern,
  not specific attacker infrastructure.
tags:
- attack.command-and-control
- attack.exfiltration
- attack.t1071.001
logsource:
  category: network_connection
  product: macos
detection:
  selection:
    DestinationPort|gte: 8000
    DestinationPort|lt: 65535
    Protocol: tcp
    User|startswith:
    - /Users/
  filter_known_services:
    Image|endswith:
    - /Applications/Slack.app/Contents/MacOS/Slack
    - /Applications/Discord.app/Contents/MacOS/Discord
    - /Applications/Spotify.app/Contents/MacOS/Spotify
    - /opt/homebrew/bin/node
  condition: selection and not filter_known_services
falsepositives:
- Development environments and local testing on high ports
- Cloud synchronization and VPN client software using non-standard ports
level: medium
id: cc012969-82dd-5273-ab4d-5053833929ea
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Source reporting: https://isc.sans.edu/diary/rss/33360

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/546bef98-f304-588a-be93-df20d5783a4b/macfinger-clickfix-campaign-targets-macos-with-amos-variant.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup