ClickFix AMOS Silent DMG Download and Mount via curl and hdiutil

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects potential malware execution chains characteristic of AMOS (Atomic macOS Stealer) and related 'ClickFix' campaigns. The rule monitors for the silent downloading of a disk image (.dmg) file to the /tmp directory using curl with quiet flags, followed immediately by the mounting of that image using hdiutil with the -nobrowse flag to bypass user notification and Gatekeeper security prompts.