A Closer Look at Malware From the Macfinger ClickFix Campaign

1. Executive summary

A macOS ClickFix campaign tracked as Macfinger ClickFix remains active and is delivering an information stealer that the reporting analyst assesses is not a variant of Atomic macOS Stealer (AMOS), contrary to earlier reporting. The chain starts on legitimate websites injected with a fingerprinting script that serves a fake verification page, then instructs the victim to paste a Terminal command that retrieves a shell-script loader and an architecture-matched Mach-O binary. The malware requests access to user folders, applications, the administrator password and the macOS Keychain, exfiltrates over HTTP POST and websocket to a hard-coded command-and-control (C2) endpoint, and installs persistence through a launch agent. No CVE is involved: this is user-executed social engineering, so patching does not remove the exposure. EMEA financial services exposure is concentrated in macOS developer and operations endpoints, where a successful infection yields Keychain material, browser credentials and wallet data.

2. Regulatory framing

No article is engaged by the mere fact that a campaign exists. The rows above are triggered by the persistence mechanism and the credential access, which change what a client must do.

3. Technical analysis & attack chain

The infection examined in the source ran on a physical host running macOS 27.0 (Golden Gate). The chain is social engineering, not exploitation of a software vulnerability, so there is no CVE, no CVSS score and no CISA KEV entry for this item.

Confirmed steps, in order:

1. A legitimate website is injected with a script that fingerprints the visitor and serves a fake CAPTCHA or verification page. On 2026-09-24 the Macfinger domain for the fake verification page was hollow-badger-moasfraum[.]life. The page injects text into the clipboard and instructs the user to paste it into Terminal.
2. The pasted command retrieves a loader from hxxp[:]//45.131.215[.]56/8031e818c7a46?force=1. The loader is a shell script. It saves a binary under the user's /Library/Caches/com.apple.securityd/ directory as com.apple.periodic. If com.apple.periodic already exists and is running, the script kills that running process.
3. The script checks the host architecture with uname -m and downloads the matching payload. Apple silicon receives the arm64 Mach-O binary from hxxp[:]//45.131.215[.]56/a7a11f95?force=1; Intel hosts receive the x86_64 binary from hxxp[:]//45.131.215[.]56/4e04813226b1b93?force=1.
4. The binary contacts the C2 server. A base64 string in the loader decodes to the C2 URL hxxp[:]//95.163.153[.]80:8133/api/t. The host reports that the arm64 download was good, then reports exec_start when the malware runs and exec_ok when it runs successfully. Subsequent POST requests to the same /api/t URL carry a Go-http-client/1.1 User-Agent.
5. The malware switches to websocket traffic, which the reporting analyst identifies as the biggest C2 difference from AMOS Stealer. It also continues HTTP POST requests. Data exfiltration uses the /api/credentials URL, with two HTTP requests in a single TCP stream and a follow-up POST reporting upload_session_ok.
6. Before exfiltrating, the malware prompts the user for access to folders and applications, then for the administrator password and the macOS Keychain password. The Keychain prompt did not accept the administrator password on the test host.
7. Persistence is installed through a .plist launch agent that runs a copy of the Mach-O binary. Copies of the binary on disk had slightly different file sizes and different SHA-256 hashes, consistent with the same binary rebuilt with minor differences.

The reporting analyst's assessment that this is not AMOS Stealer rests on four differences: the data collection and exfiltration method, the persistence mechanism, the use of a single-architecture binary rather than AMOS's combined arm64/x86_64 installer, and the websocket C2. The analyst states the malware is an information stealer but does not name the family and allows that the assessment could be wrong. Treat the family attribution as unconfirmed.

The Macfinger ClickFix campaign was documented earlier by the Ransom-ISAC Blog and named by the SANS analyst. The related Microsoft Threat Intelligence reporting describes a macOS ClickFix operation using a server-side browser-fingerprinting gate that shows the lure only to visitors whose environment looks like a genuine macOS browser, and delivering MacSync or AMOS. The related Cato Networks reporting describes a separate ClickFix campaign using fake OpenAI Codex download pages on Google Sites, with an iframe pulling content from attacker infrastructure that checks the visitor's OS and path. Those two reports describe the same technique class and overlapping tradecraft, but they are separate campaigns from the Macfinger activity in the primary item. Do not merge their indicators with the Macfinger set.

Confidence caveats. The infection detail in this advisory is single-sourced to the SANS Internet Storm Center diary of 2026-09-25. The indicators in §5 are single-sourced; verify before enforcement. The family attribution is unconfirmed and the reporting analyst explicitly leaves it open.

4. Mitigation & containment

P1, within 24 hours:

• Block the confirmed C2 and hosting infrastructure at the network boundary and in the secure web gateway: 45.131.215[.]56, 95.163.153[.]80 on TCP port 8133, and the Macfinger domain hollow-badger-moasfraum[.]life. Also block the earlier hosting IP 45.150.33[.]128 and the earlier Macfinger domain velvet-otter-glagceis[.]life from the 2026-09-22 diary.
• Hunt for the loader's on-disk artefacts. Check for a binary named com.apple.periodic under /Library/Caches/com.apple.securityd/ and for a launch agent .plist that runs a copy of the Mach-O binary. Remove both if found, and kill any running com.apple.periodic process.
• Search endpoint telemetry for the C2 URL patterns /api/t, /api/credentials and the strings exec_start, exec_ok, upload_session_ok, and for the Go-http-client/1.1 User-Agent on outbound requests to the blocked IPs.
• If a host is confirmed infected, treat all credentials as compromised. Rotate the local administrator password, the macOS Keychain password, browser-stored credentials and any wallet material on that host, and revoke sessions and tokens that were reachable from it.

P2, within 72 hours:

• Block the remaining Macfinger indicators from the 2026-09-22 diary: the velvet-otter-glagceis[.]life URL paths /t.js, /t.4b1009ff6c3f.js, /ext-b.4f9db6afd06a.js and /collect.
• Add the file hashes in §5 to EDR and AV blocklists. Note that the persistent binary copies had different hashes, so hash-only blocking will miss rebuilt copies; pair it with the behavioural detections in §6.
• Review macOS endpoint policy for the ClickFix exposure. The technique relies on the user pasting a command into Terminal, so consider restricting Terminal execution for non-developer staff, and enable any available macOS ClickFix warning behaviour. The related Malwarebytes reporting notes that macOS Tahoe 26.4 and later warn about possible ClickFix attacks.

P3, within 7 days:

• Add the §6 YARA and Sigma rules to detection tooling and tune for false positives.
• Brief macOS developer and operations staff on the ClickFix pattern: a fake verification or CAPTCHA page that asks them to paste a command into Terminal. The related Cato Networks reporting shows the same technique used with fake OpenAI Codex and Anthropic Claude Code download pages, so the lure is not limited to CAPTCHA pages.
• Confirm that the incident management process covers a persistent macOS implant, per DORA Art. 17, and that the classification and reporting path for credential and Keychain loss is documented, per DORA Art. 19 and NIS2 Art. 23.

5. Indicators of compromise

Single-sourced to the SANS Internet Storm Center diaries of 2026-09-22 and 2026-09-25. Verify before enforcement.

The source labels all hashes as SHA-256. Each value above is 64 hex characters, so the sha256 label is correct by length.

domain  hollow-badger-moasfraum[.]life
domain  velvet-otter-glagceis[.]life
ipv4  45.131.215[.]56
ipv4  45.150.33[.]128
ipv4  95.163.153[.]80
url  hxxp[:]//45.131.215[.]56/8031e818c7a46?force=1
url  hxxp[:]//45.131.215[.]56/a7a11f95?force=1
url  hxxp[:]//45.131.215[.]56/4e04813226b1b93?force=1
url  hxxp[:]//95.163.153[.]80:8133/api/t
url  hxxp[:]//95.163.153[.]80:8133/api/credentials
url  hxxps[:]//velvet-otter-glagceis[.]life/t.js?site=4f0529f47320472732961318d7d0dfd1
url  hxxps[:]//velvet-otter-glagceis[.]life/t.4b1009ff6c3f.js
url  hxxps[:]//velvet-otter-glagceis[.]life/ext-b.4f9db6afd06a.js
url  hxxps[:]//velvet-otter-glagceis[.]life/collect
url  hxxps[:]//45.150.33[.]128/92961f75b259df2?force=1
url  hxxps[:]//45.150.33[.]128/d4c8083a7d97?force=1
url  hxxps[:]//45.150.33[.]128/2286de55f9afd?force=1
sha256  c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912
sha256  457ed02b0a63ccf872e8459c91e2d1d6844a75414358849333f518cc538055b7
sha256  5a2242b862ef52fe7a08af596198412a7676c948bcd64a25ce5d2e6d4b35c6fb
sha256  3e26e006210ed398f98c090e9f1c982e76b3b73f1ce3e04ee1bf8d45c56e1a89
sha256  4a5952849232691849ed900609d7ff271ce296fe3cee4a81b58c28f2839fb5b6
sha256  6606a5f18184b224a56c9cb658fa26f7fce45099da548a30a8db2c5f2c70377c
sha256  9d87b41c2b29ccbeac851b98f1a7dce4ab4781fec0cbc55fa6f93a6299a3d564
sha256  b68cdb1b46502fbce67ce3f8110682936d06afd2116af096e30abd4c8376b6dc
sha256  1a3765e8cb0055ec31693b8f82ce9744106dee08368259661600b072c6805af4
file  /Library/Caches/com.apple.securityd/com.apple.periodic
file  SoftwareUpdate.bin

Behavioural indicators:

6. Detection

The source gives distinctive strings from the loader and C2 traffic, so a YARA rule and a Sigma rule are both supportable. The strings below are artefacts of the malware and its traffic, not of the reporting about it.

rule Macfinger_ClickFix_Loader_Strings
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-25"
        reference = "https://isc.sans.edu/diary/rss/33368"
        description = "Detects strings from the Macfinger ClickFix shell-script loader and its C2 traffic"
    strings:
        $s1 = "com.apple.periodic" ascii
        $s2 = "/Library/Caches/com.apple.securityd/" ascii
        $s3 = "uname -m" ascii
        $s4 = "/api/t" ascii
        $s5 = "/api/credentials" ascii
        $s6 = "exec_start" ascii
        $s7 = "exec_ok" ascii
        $s8 = "upload_session_ok" ascii
        $s9 = "Go-http-client/1.1" ascii
        $s10 = "force=1" ascii
    condition:
        uint32(0) == 0x464c457f or 3 of them
}

The YARA rule is written for the shell-script loader and for strings that appear in the binary and its traffic. The uint32(0) == 0x464c457f check matches Mach-O binaries; the 3 of them fallback covers the shell script and text artefacts. Tune the condition to your environment.

title: Macfinger ClickFix Loader and C2 Activity
id: 8f3c1a2e-5b7d-4e9a-9c1f-2d6e8a4b7c30
status: experimental
description: Detects the Macfinger ClickFix shell-script loader writing its binary and contacting the C2 endpoint
author: Adverse Trace
date: 2026-09-25
references:

    - https://isc.sans.edu/diary/rss/33368
    - https://isc.sans.edu/diary/rss/33360
logsource:
    category: process_creation
    product: macos
detection:
    selection_loader:
        CommandLine|contains:

            - 'com.apple.periodic'
            - '/Library/Caches/com.apple.securityd/'
            - 'uname -m'
    selection_c2:
        CommandLine|contains:

            - '/api/t'
            - '/api/credentials'
    condition: selection_loader or selection_c2
falsepositives:

    - Legitimate software that references the com.apple.securityd cache path
level: high

A network detection for the C2 endpoint is also warranted. Alert on outbound HTTP POST to /api/t or /api/credentials with a Go-http-client/1.1 User-Agent, and on websocket upgrades to the same host on TCP port 8133.

7. Sources

• SANS Internet Storm Center, "A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)", https://isc.sans.edu/diary/rss/33368, 2026-09-25.
• SANS Internet Storm Center, "Macfinger ClickFix campaign, (Tue, Sep 22nd)", https://isc.sans.edu/diary/rss/33360, 2026-09-22.
• Microsoft Threat Intelligence, "From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide", https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/, 2026-08-05.
• The Register Security, "Crooks push Mac malware through fake OpenAI Codex ads", https://www.theregister.com/security/2026/08/25/crooks-push-mac-malware-through-fake-openai-codex-ads/5291899, 2026-08-25.
• The Hacker News, "ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets", https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html, 2026-08.
• SANS Internet Storm Center, "Atomic MacOS (AMOS) stealer infection, (Sun, Aug 2nd)", https://isc.sans.edu/diary/rss/33208, 2026-08-02.
• Malwarebytes Labs, "New ClickLock Stealer locks your Mac until you hand over your password", https://www.malwarebytes.com/blog/news/2026/07/new-clicklock-stealer-locks-your-mac-until-you-hand-over-your-password, 2026-07.

8. Adverse Trace position

Adverse Trace assesses the Macfinger ClickFix campaign as a moderate, ongoing risk to EMEA financial services macOS endpoints, with the caveat that the infection detail here is single-sourced to the SANS Internet Storm Center and the malware family attribution is unconfirmed. There is no CVE and no CISA KEV entry, so this is not a patch-urgency item; the exposure is user-executed social engineering that yields Keychain material, browser credentials and wallet data, and installs a launch agent that survives reboot. The credential loss is the part that matters most for a financial sector client, because Keychain and browser credentials reach further than the infected host. We will monitor for further Macfinger indicators and for confirmation of the malware family, and we will update this advisory if the attribution is resolved or the infrastructure changes. Clients with macOS developer or operations endpoints should treat the P1 network blocks and the on-disk loader hunt as the immediate actions.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.