Executive Summary
A sophisticated social engineering campaign dubbed 'ClickFix' is targeting macOS users by utilizing fake CAPTCHA pages to deliver the Atomic macOS Stealer (AMOS). The attack differs from previous iterations by instructing users to copy and paste a malicious command into the macOS Terminal, rather than relying on manual file execution. This command automates the entire infection chain, including the silent download and mounting of malicious disk images (DMG).
Once executed, the malware harvests a wide array of sensitive data, including browser credentials, cryptocurrency wallets, and keychain files. Notably, the malware attempts to replace legitimate cryptocurrency management software like Ledger Live and Trezor Suite with malicious versions. The campaign leverages common system utilities like 'curl' and 'hdiutil' to bypass traditional security warnings and maintain a low profile during the initial compromise phase.