A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)
SANS analysis shows Macfinger ClickFix delivers a macOS infostealer distinct from AMOS Stealer, using fake CAPTCHAs, websocket C2, and Keychain password theft.
The SANS Internet Storm Center analyzes an active Macfinger ClickFix infection from 2026-09-24 and concludes the delivered infostealer is not an Atomic macOS (AMOS) Stealer variant, citing differences in persistence, exfiltration, and architecture-specific arm64/x86_64 Mach-O binaries. A fake CAPTCHA page tricks users into pasting a shell command that downloads a loader from 45.131.215.56, which installs a binary masquerading as com.apple.periodic in /Library/Caches. The malware uses websocket C2 at 95.163.153.80:8133/api/t, exfiltrates stolen data via /api/credentials POST requests, prompts for administrator and Keychain passwords, and persists via a LaunchAgent plist (com.apple.softwareupdated.plist) running a copy from /Library/Caches.
- Stealer delivered by Macfinger ClickFix judged distinct from AMOS Stealer
- Architecture-specific arm64/x86_64 Mach-O payloads from 45.131.215.56
- WebSocket C2 and HTTP POST exfiltration of credentials
- Persistence via com.apple.softwareupdated.plist LaunchAgent
- Prompts harvest administrator and macOS Keychain passwords
- ATT&CK
- T1059.004 Unix ShellT1547.011 Plist ModificationT1555 Credentials from Password StoresT1041 Exfiltration Over C2 Channel
- Malware
- AMOS Stealer
- Organizations
- SANS Internet Storm Center
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | hollow-badger-moasfraum.life | 24, the Macfinder domain for the fake verification page was hollow-badger-moasfraum[.]life . The clipboard-injected text was similar to what I repor |
| ipv4 | 45.131.215.56 | Activity The ClickFix text retrieved a loader from hxxp[:]//45.131.215[.]56/8031e818c7a46?force=1 . This loader is a shell script, an |
| ipv4 | 95.163.153.80 | above image translates to a URL for the C2 server: hxxp[:]//95.163.153[.]80:8133/api/t Post-Infection C2 Traffic The post-infection C |
| sha256 | 3e26e006210ed398f98c090e9f1c982e76b3b73f1ce3e04ee1bf8d45c56e1a89 | ion: arm64 Mach-O binary from 45.131.215[.]56 SHA-256 hash: 3e26e006210ed398f98c090e9f1c982e76b3b73f1ce3e04ee1bf8d45c56e1a89 Description: arm64 Mach-O binary first saved to disk com.ap |
| sha256 | 457ed02b0a63ccf872e8459c91e2d1d6844a75414358849333f518cc538055b7 | ion: Shell script loader from 45.131.215[.]56 SHA-256 hash: 457ed02b0a63ccf872e8459c91e2d1d6844a75414358849333f518cc538055b7 Description: x86_64 Mach-O binary from 45.131.215[.]56 SHA- |
| sha256 | 4a5952849232691849ed900609d7ff271ce296fe3cee4a81b58c28f2839fb5b6 | binary first saved to disk com.apple.periodic SHA-256 hash: 4a5952849232691849ed900609d7ff271ce296fe3cee4a81b58c28f2839fb5b6 Description: Persistent arm64 Mach-O binary SoftwareUpdate. |
| sha256 | 5a2242b862ef52fe7a08af596198412a7676c948bcd64a25ce5d2e6d4b35c6fb | on: x86_64 Mach-O binary from 45.131.215[.]56 SHA-256 hash: 5a2242b862ef52fe7a08af596198412a7676c948bcd64a25ce5d2e6d4b35c6fb Description: arm64 Mach-O binary from 45.131.215[.]56 SHA-2 |
| sha256 | c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912 | ces from each other. Indicators of Compromise SHA-256 hash: c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912 Description: Shell script loader from 45.131.215[.]56 SHA-2 |
| url | http://45.131.215.56/4e04813226b1b93?force=1 | [:]//45.131.215[.]56/a7a11f95?force=1 x86_64 Mach-O binary: hxxp[:]//45.131.215[.]56/4e04813226b1b93?force=1 Shown above: A later section of the downloaded shell sc |
| url | http://45.131.215.56/8031e818c7a46?force=1 | . Loader Activity The ClickFix text retrieved a loader from hxxp[:]//45.131.215[.]56/8031e818c7a46?force=1 . This loader is a shell script, and it saves a binary |
| url | http://45.131.215.56/a7a11f95?force=1 | e x86_64 . The corresponding URLs are: arm64 Mach-O binary: hxxp[:]//45.131.215[.]56/a7a11f95?force=1 x86_64 Mach-O binary: hxxp[:]//45.131.215[.]56/4e048132 |
| url | http://95.163.153.80:8133/api/credentials | ]//45.131.215[.]56/a7a11f95?force=1 Post-infection C2 URLs: hxxp[:]//95.163.153[.]80:8133/api/credentials hxxp[:]//95.163.153[.]80:8133/api/shell/agent hxxp[:]// |
| url | http://95.163.153.80:8133/api/shell/agent | tion C2 URLs: hxxp[:]//95.163.153[.]80:8133/api/credentials hxxp[:]//95.163.153[.]80:8133/api/shell/agent hxxp[:]//95.163.153[.]80:8133/api/t Final Words As note |
| url | http://95.163.153.80:8133/api/t | n in the above image translates to a URL for the C2 server: hxxp[:]//95.163.153[.]80:8133/api/t Post-Infection C2 Traffic The post-infection C2 traffic |
From the original article
5 min read at isc.sans.edu
My previous post on Macfinger ClickFix was two days ago, and this campaign remains active. The more I look into the malware delivered by this campaign, the more I believe it is not a variant of Atomic macOS (AMOS) Stealer as originally reported. There are too many differences between what I've documented with recent AMOS Stealer activity and what I'm now seeing with this malware.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.