ClickFix AMOS: Silent DMG Mount via curl and hdiutil from Terminal

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•6

Detects the AMOS (Atomic macOS Stealer) infection chain where a shell (e.g., Terminal, bash) executes curl to download a DMG file to a temporary directory, followed immediately by the use of hdiutil with the -nobrowse flag to mount the disk image silently, effectively bypassing macOS Gatekeeper UI prompts to the user.