macOS ClickFix Attack Silently Deploys AMOS Infostealer via Fake CAPTCHA Terminal Commands

Security researchers at Palo Alto Networks Unit 42 have uncovered a new macOS ClickFix campaign that uses Terminal commands to silently download, mount, and execute infostealing malware. The campaign targets Mac users with fake CAPTCHA pages and deploys the Atomic macOS Stealer (AMOS) to harvest browser credentials, cryptocurrency wallets, and Apple Keychain data.

What Happened: macOS ClickFix Campaign Delivers Atomic Stealer via Silent DMG

The campaign represents an evolution in ClickFix social engineering tactics. Previous campaigns typically required victims to manually open downloaded files or execute scripts. However, this new approach automates the entire infection chain through a single Terminal command.

The attack begins when a victim visits a compromised or malicious website that displays a fake CAPTCHA verification page. The page instructs the user to open Terminal and paste a provided command to “verify” themselves. Once executed, the command downloads a malicious disk image (DMG) file from an attacker-controlled server, mounts it silently using macOS’s native hdiutil utility, and automatically launches the embedded malware.

ClickFix is a social engineering technique that has grown significantly in popularity over the past year. It uses fake CAPTCHAs, browser errors, or system alerts to trick visitors into executing attacker-supplied instructions. Both cybercriminals and state-sponsored groups have adopted this method to distribute malware across platforms.

Technical Details of the macOS ClickFix Attack

The attack chain observed by Palo Alto Networks follows a precise multi-stage execution path. First, the victim copies and runs a Terminal command from the fake CAPTCHA page. The command uses curl with quiet flags (-fsSL) to download a DMG file from svs-verificationdate[.]beer to the /tmp directory under a random filename.

Next, the command executes hdiutil attach -nobrowse to mount the downloaded disk image without displaying it in Finder or on the desktop. This stealthy mounting technique helps the attack evade casual user detection.

The script then searches up to three directory levels deep for the first available .app or .pkg installer. If found, it launches the application using the macOS open command. Researchers observed the malware delivered as a disk image named “s.01M0td.dmg,” which mounted a volume containing a self-signed application bundle named “NNApp.app.”

This payload belongs to the Atomic macOS Stealer (AMOS) family. AMOS is commercial infostealing malware sold to cybercriminals through subscription models. It is specifically designed to target macOS systems and extract high-value data.

Data Exfiltration Capabilities

The malware displays a fake System Preferences authentication prompt to harvest the victim’s password. Once obtained, AMOS extracts a wide range of sensitive data:

• Browser credentials: Chrome, Edge, Brave, Opera, Arc, Vivaldi, CocCoc, Yandex, Firefox, LibreWolf, SeaMonkey, Tor Browser, Waterfox, and Zen Browser — including cookies, login databases, autofill data, and stored payment cards
• Cryptocurrency wallets: Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, DashCore, Guarda, Binance Wallet, Dogecoin Wallet, and TonKeeper
• Application data: Telegram Desktop and Discord data
• System data: Apple Keychain database files, Safari cookies, and Apple Notes databases
• User documents: PDF, TXT, and RTF files

All harvested data is compressed into a ZIP archive and uploaded to the attacker’s command-and-control infrastructure. Researchers identified C2 servers at svs-verificationdate[.]beer and 196.251.107[.]171.

Furthermore, the malware replaces legitimate installations of Ledger Live and Trezor Suite with malicious versions. This substitution likely enables the attackers to redirect cryptocurrency transactions and steal funds.

Business and Operational Impact

The macOS ClickFix campaign carries significant consequences for both individual users and organizations. The impact spans multiple categories:

• Credential exposure: Stolen browser credentials can lead to account takeovers across corporate SaaS platforms, cloud services, and financial institutions
• Cryptocurrency theft: The wallet replacement technique enables direct fund theft rather than just data harvesting
• Corporate data leakage: Exfiltrated documents, Keychain data, and messaging app content may contain intellectual property or confidential communications
• Reputational risk: Organizations whose users fall victim to these attacks may face questions about security awareness training and endpoint protection
• Mac platform targeting: The campaign demonstrates that macOS is increasingly treated as a viable target by financially motivated threat actors, challenging the outdated perception that Macs are inherently safer

For businesses, a single compromised developer or executive Mac could cascade into broader supply chain or infrastructure compromises. Browser credentials often include access tokens for cloud providers, code repositories, and CI/CD pipelines.

Mitigation and Recommendations

Defenders must address both user awareness and technical controls to mitigate this threat effectively.

Immediate Actions for Defenders

1. Block known indicators. Block C2 domains svs-verificationdate[.]beer and IP 196.251.107[.]171 at the DNS and network perimeter levels
2. Monitor for suspicious DMG mounts. Alert on hdiutil attach commands executed from Terminal, particularly those using -nobrowse flags
3. Audit for AMOS indicators. Check for self-signed applications in unusual locations, particularly within /tmp or /Users/*/Library directories
4. Scan for Ledger and Trezor replacements. Verify the integrity of cryptocurrency wallet applications by comparing checksums against official vendor releases

User Awareness and Training

The most effective defense against ClickFix attacks is user education. Security teams should communicate the following guidance:

• Never paste commands from websites into Terminal, PowerShell, or any command-line interface
• Legitimate CAPTCHAs never require running system commands
• Verify application signatures before launching downloaded software (right-click, select “Get Info,” and check the code signature)
• Report suspicious verification prompts to the IT security team immediately

macOS Hardening Strategies

Organizations should implement additional macOS-specific protections. Keep Gatekeeper enabled to prevent unsigned applications from launching. Furthermore, configure application whitelisting through MDM profiles to restrict execution to approved software. Finally, deploy endpoint detection and response (EDR) solutions that monitor for DMG mounting, suspicious curl executions, and credential access events.

Bottom line: The macOS ClickFix campaign demonstrates how social engineering techniques are evolving to exploit user trust in familiar interfaces. Silent DMG mounting through Terminal commands bypasses the manual interaction previously required in macOS malware campaigns. Users must understand that no legitimate website will ever ask them to run Terminal commands, and organizations must treat macOS endpoints with the same security rigor as Windows systems.

Incident Summary

Threat Name:	Atomic macOS Stealer (AMOS) via ClickFix Social Engineering
Target Platform:	macOS
Attack Vector:	Fake CAPTCHA pages instructing users to paste Terminal commands
Malware Family:	Atomic macOS Stealer (AMOS)
Disclosed by:	Palo Alto Networks Unit 42
Disclosure Date:	June 2026
C2 Infrastructure:	svs-verificationdate[.]beer, 196.251.107[.]171
Patch Status:	No software patch applicable — user awareness and network controls are primary defenses

References

1. Palo Alto Networks Unit 42, “New macOS ClickFix Attack Silently Mounts DMGs to Push Infostealer,” BleepingComputer, June 26, 2026, https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/ (accessed June 28, 2026)
2. CISA, “Alert (AA24-060A): Social Engineering Attacks Conducted by Threat Actors Using Fake CAPTCHA,” https://www.cisa.gov/news-events/cybersecurity-advisories (accessed June 28, 2026)