ClickFix Campaigns Expand to macOS AMOS Malware

The ClickFix social engineering technique has evolved from a Windows-centric nuisance into a cross-platform threat adopted by both cybercriminals and state-sponsored actors, including groups linked to North Korea (TA427), Iran (TA450), and Russia (TA422). The attack bypasses traditional security controls by tricking users into becoming the execution engine, instructing them to paste malicious commands into system utilities like Terminal or the Windows Run dialog.

A newly identified macOS variant, first reported in June 2026, utilizes fake CAPTCHA prompts to trick users into executing commands that silently download and mount malicious Disk Images (DMG). These DMGs deploy the Atomic macOS Stealer (AMOS), specifically the C++ Odyssey variant, which targets sensitive data including Apple Keychain, browser credentials, and cryptocurrency wallets. This expansion highlights a significant shift as operators build platform-specific kill chains to circumvent modern endpoint detection and response (EDR) solutions.

For organizations, this threat is particularly dangerous because it exploits trusted system processes (e.g., explorer.exe, Terminal.app) and relies on user-initiated actions that often bypass UAC or security prompts. Defenders must pivot from traditional file-based detection to process lineage monitoring and user education focused on this specific social engineering primitive.