New macOS ClickFix attack silently mounts DMGs to push infostealer

1. Executive summary

A new macOS ClickFix campaign uses fake CAPTCHA pages to trick users into pasting a Terminal command that silently downloads, mounts, and launches a malicious DMG containing the Atomic macOS Stealer (AMOS) infostealer. The payload targets credentials, authentication tokens, Keychain entries, cryptocurrency wallet data, and replaces legitimate Ledger Live and Trezor Suite installations with trojanised versions. Command-and-control infrastructure has been observed at svs-verificationdate[.]beer and 196.251.107[.]171. EMEA financial services firms with macOS-using treasury, trading, or developer staff are at elevated risk because the stealer specifically targets crypto wallets and replaces hardware-wallet companion apps — a direct threat to digital asset custody workflows. No CVE is associated with this campaign; severity is driven by credential and asset theft impact, not a scored vulnerability.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Initial access — social engineering. Victim lands on a page presenting a fake CAPTCHA, browser error, or system alert (the "ClickFix" pattern). The page instructs the user to open Terminal and paste a "verification" command.
2. Command execution. User pastes the command into Terminal and executes it. The command runs under the user's own UID (no privilege escalation required at this stage).
3. Payload staging. The command invokes curl with the quiet flags -fsSL to download a malicious DMG from svs-verificationdate[.]beer and writes it to /tmp under a randomised filename. Observed artefact filename: s.01M0td.dmg.
4. Silent mount. The script executes hdiutil attach -nobrowse against the downloaded DMG. The -nobrowse flag suppresses the volume from appearing in Finder or on the desktop, hiding the mount from the user.
5. Bundle discovery and launch. The script recursively searches up to three directory levels inside the mounted volume for the first available .app or .pkg installer. Observed bundle: NNApp.app (self-signed). It launches the bundle via the macOS open command.
6. User-mode credential capture. AMOS displays a fake "System Preferences" authentication prompt and harvests the password the user enters.
7. Data collection. AMOS enumerates and exfiltrates: - 8 Chromium-based browsers: Google Chrome, Microsoft Edge, Brave, Opera, Arc, Vivaldi, CocCoc, Yandex — cookies, login databases, autofill, stored payment cards, profile data. - 5 Firefox-derived browsers: LibreWolf, SeaMonkey, Tor Browser, Waterfox, Zen Browser — same data classes. - Crypto wallets: Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, DashCore, Guarda, Binance Wallet, Dogecoin Wallet, TonKeeper. - Telegram Desktop and Discord data. - Apple Notes databases, Safari cookies, Apple Keychain database files. - User documents with .pdf, .txt, .rtf extensions.
8. Supply-chain compromise of wallet software. AMOS replaces legitimate installations of Ledger Live and Trezor Suite with malicious versions, enabling downstream crypto theft.
9. Exfiltration. Harvested data is archived into a ZIP and uploaded to attacker-controlled infrastructure (svs-verificationdate[.]beer, 196.251.107[.]171).

Technical specifics that matter to a defender

• Initial vector: ClickFix social engineering — fake CAPTCHA instructing Terminal paste-and-run. No exploit, no CVE; pure user action.
• Native tooling abused: curl -fsSL (download), hdiutil attach -nobrowse (silent mount), open (launch). All are legitimate macOS binaries living in standard paths — detection must be behavioural, not hash-based.
• Mount technique: hdiutil attach -nobrowse is the key stealth primitive. A normal user-initiated mount uses Finder and surfaces the volume; -nobrowse suppresses this and is a strong signal when invoked from a shell.
• Discovery depth: Three-directory recursive search for .app/.pkg — defenders should expect arbitrary bundle names inside the mounted volume.
• Persistence: Not described in the source material; treat as unconfirmed for this campaign. The trojanised Ledger Live / Trezor Suite replacement functions as a persistence mechanism for any user who subsequently launches the wallet app.
• Privilege escalation: Not described in the source material; treat as unconfirmed. The fake System Preferences prompt is a user-trust play, not a technical escalation.
• C2 / exfil: svs-verificationdate[.]beer (domain) and 196.251.107[.]171 (IPv4). Both serve as payload host and exfil destination.
• Targeted software supply chain: Ledger Live and Trezor Suite are explicitly replaced. Any environment using these for treasury or custody operations must treat the wallet host as compromised even if no other AMOS indicators are present.

Caveated / unconfirmed

• The threat actor is not named in the source material and no MITRE-attributed profile is available; treat any attribution as unconfirmed.
• No CVE, CVSS, or CISA KEV state applies — this is a social-engineering campaign, not a vulnerability exploitation.
• Persistence, privilege escalation, and lateral movement behaviours are not described in the source; do not assume they are absent.

4. Mitigation & containment

P1 — within 24 hours (containment)

• Block C2 at the perimeter. Sinkhole / block svs-verificationdate[.]beer and 196.251.107[.]171 at DNS resolver, web proxy, and firewall egress. Add to threat-intel feeds.
• Hunt for the mount primitive. Query EDR / shell-history telemetry for hdiutil attach -nobrowse invocations originating from Terminal, bash, zsh, or sh on macOS endpoints in the last 30 days. Any hit is a confirmed indicator of this campaign or a closely related ClickFix variant.
• Hunt for the bundle. Search endpoints for the file NNApp.app and any .app/.pkg bundles mounted from DMGs written to /tmp in the last 30 days.
• Isolate suspect hosts. Quarantine any macOS endpoint with a positive hit; preserve a forensic image before reimaging.
• Force credential rotation. For any confirmed-compromised user: rotate macOS login password, rotate Keychain (iCloud Keychain sync should be paused until clean), rotate all browser-stored credentials, rotate crypto-wallet seeds treated as exposed, and revoke active sessions for Telegram, Discord, and any SSO/IdP tokens cached in browsers.
• Re-verify wallet software. On any host that ran Ledger Live or Trezor Suite, treat the installed binary as untrusted; reinstall from the vendor's official site and verify the publisher signature before further use.

P2 — within 72 hours (remediation)

• User awareness push. Issue an immediate comms to all macOS users (especially treasury, trading, dev, and exec functions) warning against pasting Terminal commands from web pages. Reinforce: no legitimate CAPTCHA, CAPTCHA-fix, or browser-error workflow requires Terminal.
• Browser credential purge. Force a password-manager reset and re-issue of all credentials for users who may have interacted with the lure; do not rely on browser autofill caches.
• EDR rule deployment. Roll out the Sigma rules in §6 across the macOS fleet.

P3 — within 7 days (hardening)

• Restrict Terminal for standard users. Where feasible, gate Terminal.app and bash/zsh execution behind an admin-only policy or remove from standard-user docks.
• Application allowlisting. Deploy a macOS allowlist that blocks execution from /tmp, ~/Downloads, and mounted DMG volumes; require code-signing verification for any .app launch.
• Gatekeeper / notarisation enforcement. Confirm Gatekeeper is set to enforce notarisation and that users cannot override via "Open Anyway" without admin credentials.
• XProtect / MRT updates. Confirm Apple XProtect and MRT definitions are current; verify the EDR product has signatures for AMOS / Atomic Stealer family.
• Vendor risk review. Under NIS2 Art. 21(2)(d), document the supply-chain exposure to Ledger Live and Trezor Suite and the controls in place to detect tampering of these binaries on managed endpoints.

5. Indicators of compromise

domain  svs-verificationdate[.]beer
ipv4    196.251.107[.]171
filename        s.01M0td.dmg
filename        NNApp.app
command hdiutil attach -nobrowse
command curl -fsSL

6. Detection

YARA rule (file- and string-based)

rule AT_2026_06_24_160_ClickFix_AMOS_DMG
{
    meta
        author      = "Adverse Trace"
        date        = "2026-06-24"
        description = "Detects artefacts associated with the macOS ClickFix campaign delivering Atomic macOS Stealer (AMOS) via silently mounted DMGs"
        reference   = "https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/"
        tlp         = ""

    strings
        $dmg_name      = "s.01M0td.dmg" ascii nocase
        $app_bundle    = "NNApp.app" ascii nocase
        $c2_domain     = "svs-verificationdate" ascii nocase
        $mount_cmd     = "hdiutil attach -nobrowse" ascii nocase
        $curl_flags    = "curl -fsSL" ascii nocase
        $fake_pref_pw  = "System Preferences" ascii nocase
        $ledger_swap   = "Ledger Live" ascii nocase
        $trezor_swap   = "Trezor Suite" ascii nocase

    condition
        3 of them
}

Sigma rule (process / behavioural)

title: macOS ClickFix - hdiutil silent mount from shell with curl staging in /tmp
id: AT-2026-06-24-160-001
status: experimental
description: >
    Detects the ClickFix campaign pattern where a shell process downloads a DMG
    to /tmp via curl and silently mounts it with hdiutil attach -nobrowse,
    then launches an .app bundle. Reference: AT-2026-06-24-160.
author: Adverse Trace
date: 2026-06-24
references:

    - https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/
logsource:
    product: macos
    category: process_creation
detection:
    selection_curl:
        Image|endswith:

            - '/curl'
        CommandLine|contains|all:

            - '-fsSL'
            - '/tmp'
    selection_hdiutil:
        Image|endswith:

            - '/hdiutil'
        CommandLine|contains|all:

            - 'attach'
            - '-nobrowse'
    selection_open:
        Image|endswith:

            - '/open'
        CommandLine|contains:

            - '/tmp'
    parent_shell:
        ParentImage|endswith:

            - '/bash'
            - '/zsh'
            - '/sh'
            - '/Terminal'
    condition: selection_curl or selection_hdiutil or selection_open
fields:

    - User
    - CommandLine
    - ParentCommandLine
falsepositives:

    - Legitimate admin scripts that mount DMGs silently (rare; review parent process)
level: high
tags:

    - attack.initial_access
    - attack.execution
    - attack.t1059.004
    - attack.t1105

7. Sources

• BleepingComputer, "New macOS ClickFix attack silently mounts DMGs to push infostealer," 23 June 2026. https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/
• Palo Alto Networks Unit 42 (research underlying the BleepingComputer reporting, as cited in the source).

8. Adverse Trace position

Severity: High impact, even though no CVE underpins this campaign. AMOS delivers broad credential theft (Keychain, browser, messaging), targets 16 wallet applications, and performs a supply-chain swap of Ledger Live and Trezor Suite — meaning any financial-services user who runs the lure should be treated as fully compromised pending forensic confirmation. Client impact: EMEA financial services firms with macOS-using treasury, trading, or developer staff are the priority cohort; crypto-custody and Web3-adjacent workflows are most exposed. Next steps: Adverse Trace will (a) push svs-verificationdate[.]beer and 196.251.107[.]171 to client blocklists within 24 hours, (b) deploy the Sigma rule across managed macOS estates, (c) assist with forensic triage and credential-rotation scoping for any confirmed-positive endpoint, and (d) incorporate the Ledger Live / Trezor Suite supply-chain swap into ongoing vendor-risk reviews under NIS2 Art. 21(2)(d). Attribution remains unconfirmed; no MITRE-actor profile is associated with this campaign in the source material.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.