Researchers at Palo Alto Networks Unit 42 detected a new macOS ClickFix campaign that employs Terminal commands to download, mount, and launch information-stealing malware. This campaign infects Mac devices with the Atomic macOS Stealer (AMOS) infostealer.

The campaign starts with a fake CAPTCHA page that directs users to open Terminal and paste a command for verification. The executed command then downloads a malicious disk image (DMG) file from an attacker-controlled server. This DMG file, observed by researchers to be named 's.01M0td.dmg,' is saved to the /tmp folder under a random filename.

The command utilizes the macOS native hdiutil utility to silently mount the disk image, executing 'hdiutil attach -nobrowse' to prevent its display in Finder or on the desktop. Following the mounting, the command locates the application bundle within the DMG by searching up to three directory levels deep for the first available .app or .pkg installer. If an installer is identified, the script launches it using the macOS open command.

The mounted volume contains a self-signed application bundle named 'NNApp.app,' which is part of the Atomic macOS Stealer family. Once active, the stealer presents a fake System Preferences authentication prompt, asking the user for their password. The malware targets various browsers, including eight Chromium-based browsers such as Google Chrome, Microsoft Edge, Brave, Opera, Arc, Vivaldi, CocCoc, and Yandex. It also targets Firefox-derived browsers like LibreWolf, SeaMonkey, Tor Browser, Waterfox, and Zen Browser.

The AMOS malware is designed to steal cookies, login databases, autofill information, stored payment cards, and browser profile data from these targeted browsers. Additionally, it searches for and steals cryptocurrency wallet data from applications including Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, DashCore, Guarda, Binance Wallet, Dogecoin Wallet, and TonKeeper. The malware further extracts data from Telegram Desktop and Discord, along with Apple Notes databases, Safari cookies, and Apple Keychain database files.

The campaign also focuses on user documents with PDF, TXT, or RTF extensions. Harvested data is compressed into a ZIP archive and uploaded to the attacker's server. In some instances, the malware replaces legitimate installations of Ledger Live and Trezor Suite with malicious versions. The campaign utilized command-and-control servers located at svs-verificationdate[.]beer and 196.251.107[.]171 for its operations.

Why It Matters

This newly identified ClickFix campaign represents an evolution in social engineering tactics aimed at macOS users, as it automates steps that previously required user interaction. The Silent execution of malware via Terminal commands bypasses visual cues that might alert users to suspicious activity, making the attack more difficult to detect. The Atomic macOS Stealer targets an extensive array of sensitive personal information, including browser credentials, financial data from cryptocurrency wallets, and private documents, posing a broad risk to data security and privacy for affected individuals.