ClickFix macOS AMOS Delivery via Terminal bash ClickFix Payload

Ethan Andrews@eandrews

•updated Jun 23, 2026•1•0•11

Detects user-initiated Terminal execution of a ClickFix bash payload copied from a fake CAPTCHA page. The command uses mktemp to create a /tmp DMG, downloads it via curl -fsSL from svs-verificationdate.beer, then silently mounts it with hdiutil attach -nobrowse to deliver the Atomic macOS Stealer (AMOS).