New macOS ClickFix attack silently mounts DMGs to push infostealer
New macOS ClickFix campaign silently mounts DMGs to distribute Atomic macOS Stealer infostealer malware.
A new macOS ClickFix campaign uses fake CAPTCHA pages to trick users into executing Terminal commands that silently download and mount malicious DMG files containing the Atomic macOS Stealer (AMOS) infostealer. The malware steals browser credentials, cryptocurrency wallet data, Keychain information, and user documents from infected devices. The attack combines social engineering with automated execution, eliminating the need for manual user interaction to launch the malware.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Palo Alto Networks?
Get an email when a new story names Palo Alto Networks, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThis attack exploits human trust by presenting fake CAPTCHA pages that instruct users to paste and execute malicious Terminal commands, bypassing traditional malware delivery defenses entirely. The social engineering technique known as ClickFix is particularly dangerous because it weaponizes the user themselves, making security tools that scan for malicious downloads less effective. Once executed, the command silently mounts a DMG file and deploys the Atomic macOS Stealer, exfiltrating credentials, Keychain data, and cryptocurrency wallet information. This matters because macOS users often operate under a false sense of security, and attacks that leverage native OS tools like Terminal are harder to detect with conventional antivirus solutions.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — svs-verificationdate.beer
- malware — Atomic macOS Stealer (AMOS)
- malware — NNApp.app