A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)
SANS analysis shows Macfinger ClickFix delivers a macOS infostealer distinct from AMOS Stealer, using fake CAPTCHAs, websocket C2, and Keychain password theft.
50
Malware
AMOS Stealer
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 16, 2026
- Last mentionedSep 25, 2026
Timeline
2 articles · newest firstAtomic macOS (AMOS) Stealer Activity
Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.
45
Appears with
- Binanceproduct · 1
- Telegramproduct · 1
- TonKeeperproduct · 1
- Palo Alto Unit 42organization · 1
- SANS Internet Storm Centerorganization · 1
- FileZillaproduct · 1
- Palo Alto Unit 42vendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.