MacFinger ClickFix Malware Campaign: A Closer Look at the Threat
A sophisticated malware campaign targeting Mac users has been making headlines lately, with reports suggesting a link to the Atomic macOS (AMOS) Stealer. However, further investigation by cybersecurity experts reveals significant differences between this new threat and its alleged counterpart. The malware in question, delivered through the MacFinger ClickFix campaign, is an information stealer that collects sensitive data from infected systems.
The campaign’s fake CAPTCHA/verification page uses a domain name (hollow-badger-moasfraum[.]life) that was used on September 24th to infect a physical host running macOS 27.0 (Golden Gate). The clipboard-injected text, similar to what was reported earlier, was entered into a Terminal window, triggering the malware’s activation.
Upon further analysis of the infection, researchers noticed that the ClickFix text retrieved a loader from a URL hosted on IP address 45.131.215[.]56. This loader is a shell script that saves a binary under the user’s /Library/Caches/com.apple.securityd/ directory as com.apple.periodic. If the process already exists and is running, the script will kill it. The script then checks the system’s architecture using uname -m and downloads the corresponding payload depending on whether the system uses Apple silicon (arm64) or an Intel processor (x86_64).
The malware’s communication with its command-and-control (C2) server is facilitated through websocket traffic, a significant departure from AMOS Stealer’s approach. Infected hosts report to the C2 server that the download was successful and provide additional information, including User-Agent strings (Go-http-client/1.1). The data exfiltration process involves HTTP POST requests to the /api/t URL, with subsequent requests using websockets.
The implications of this malware campaign are concerning, as it can potentially compromise sensitive user data. To mitigate these risks, Mac users should be cautious when interacting with suspicious websites or clicking on unfamiliar links. It is essential to keep software up-to-date and use reputable security solutions to detect and prevent such threats. By being aware of the tactics used by this malware campaign, users can take proactive steps to protect themselves against similar attacks in the future.
Practical takeaway: Regularly review your system’s security settings and ensure that your antivirus software is updated with the latest definitions to detect emerging threats like MacFinger ClickFix. Additionally, be cautious when interacting with unfamiliar websites or clicking on suspicious links, as these can be vectors for malware delivery.
Source: SANS ISC — 2026-09-25