[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flkoM3S_j6NoHtL_d_occjzTSX3Qx37eOust_CBdyKA0":3},{"article":4,"iocs":37,"watch_terms":47,"solutions":48,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"39c70eeb-5dd4-4fbb-86e1-7e7c4d1f66cc","New macOS ClickFix attack silently mounts DMGs to push infostealer","new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer-dca893","A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. [...]","A new macOS ClickFix campaign uses fake CAPTCHA pages to trick users into executing Terminal commands that silently download and mount malicious DMG files containing the Atomic macOS Stealer (AMOS) infostealer. The malware steals browser credentials, cryptocurrency wallet data, Keychain information, and user documents from infected devices. The attack combines social engineering with automated execution, eliminating the need for manual user interaction to launch the malware.","New macOS ClickFix campaign silently mounts DMGs to distribute Atomic macOS Stealer infostealer malware.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2022\u002F03\u002F22\u002Fmacos-storm.jpg","2026-06-23T18:30:16+00:00","2026-06-23T20:00:09.826173+00:00",8,[17,20,23,26],{"name":18,"type":19},"ClickFix campaign operators","threat_actor",{"name":21,"type":22},"Atomic macOS Stealer (AMOS)","product",{"name":24,"type":25},"Palo Alto Networks","vendor",{"name":27,"type":28},"macOS ClickFix DMG campaign","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},[38,42,44],{"type":39,"value":40,"context":41},"domain","svs-verificationdate.beer","Attacker-controlled server hosting malicious DMG file",{"type":33,"value":21,"context":43},"Info-stealing malware targeting credentials, wallets, and Keychain data",{"type":33,"value":45,"context":46},"NNApp.app","Malicious application bundle delivered via DMG file s.01M0td.dmg",[24,21],{"controls":49,"vendors":133},[50,78,107],{"slug":51,"name":52,"problem":53,"products":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[55,62,70],{"vendor_slug":56,"vendor_name":24,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":79,"name":80,"problem":81,"products":82},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"slug":108,"name":109,"problem":110,"products":111},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[112,118,125],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":113,"product_name":114,"url":116,"description":117},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":122,"url":123,"description":124},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[134],{"slug":56,"name":24,"logo_path":57,"roles":135},[136],"reported_by",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":155},"macos-clickfix-campaign-tricks-users-into-running-malicious-terminal-commands","macOS ClickFix Campaign Tricks Users Into Running Malicious Terminal Commands","This attack exploits human trust by presenting fake CAPTCHA pages that instruct users to paste and execute malicious Terminal commands, bypassing traditional malware delivery defenses entirely. The social engineering technique known as ClickFix is particularly dangerous because it weaponizes the user themselves, making security tools that scan for malicious downloads less effective. Once executed, the command silently mounts a DMG file and deploys the Atomic macOS Stealer, exfiltrating credentials, Keychain data, and cryptocurrency wallet information. This matters because macOS users often operate under a false sense of security, and attacks that leverage native OS tools like Terminal are harder to detect with conventional antivirus solutions.",[142,143,144,145,146,147,148,149,150,151,152,153,154],"CIS Control 3: Data Protection","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 CM-7: Least Functionality","NIST CSF DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing (credential\u002FPII data at risk)","MITRE ATT&CK T1204.002: User Execution – Malicious File","MITRE ATT&CK T1059.004: Command and Scripting Interpreter – Unix Shell","MITRE ATT&CK T1555.001: Credentials from Password Stores – Keychain",{}]