ClickFix AMOS macOS Terminal bash one-liner with curl and hdiutil

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects suspicious bash one-liners executed within macOS Terminal typically associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The rule monitors for a sequence involving temporary file creation, downloading a disk image (DMG) from a known malicious domain ('svs-verificationdate.beer'), and silently attaching the DMG via hdiutil.