A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)
SANS analysis shows Macfinger ClickFix delivers a macOS infostealer distinct from AMOS Stealer, using fake CAPTCHAs, websocket C2, and Keychain password theft.
The SANS Internet Storm Center analyzes an active Macfinger ClickFix infection from 2026-09-24 and concludes the delivered infostealer is not an Atomic macOS (AMOS) Stealer variant, citing differences in persistence, exfiltration, and architecture-specific arm64/x86_64 Mach-O binaries. A fake CAPTCHA page tricks users into pasting a shell command that downloads a loader from 45.131.215.56, which installs a binary masquerading as com.apple.periodic in /Library/Caches. The malware uses websocket C2 at 95.163.153.80:8133/api/t, exfiltrates stolen data via /api/credentials POST requests, prompts for administrator and Keychain passwords, and persists via a LaunchAgent plist (com.apple.softwareupdated.plist) running a copy from /Library/Caches.