CyberNew CyberNew
Ransomware & Malware Isc 2 weeks ago

A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)

CN
CyberNew Threat Research Desk
• Original Reporting: Isc
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Client Endpoints & Operating Systems
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"Introduction My previous post on Macfinger ClickFix was two days ago, and this campaign remains active. The more I look into the malware delivered by this campaign, the more I believe it is not a variant of Atomic macOS (AMOS) Stealer as originally reported. There are too many differences between what I've documented with recent AMOS Stealer activity and what I'm now seeing with this malware. The..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Introduction

My previous post on Macfinger ClickFix was two days ago, and this campaign remains active. The more I look into the malware delivered by this campaign, the more I believe it is not a variant of Atomic macOS (AMOS) Stealer as originally reported. There are too many differences between what I've documented with recent AMOS Stealer activity and what I'm now seeing with this malware. The data collection and method of exfiltration is different between these two malware families. The persistence mechanism is different. Finally, AMOS Stealer uses an installer with a combined arm64/x86_64 architecture, but this malware uses either an arm64 or an x86_64 Mach-O binary depending on the architecture of the victim's host. There are too many differences with this malware.

The malware delivered by Macfinger ClickFix is indeed an information stealer. I just don't know what to call it.

In an attempt to find out, this diary examines an infection from the Macfinger ClickFix campaign on Thursday, 2026-09-24. This infection was on a physical host running macOS 27.0 (Golden Gate).


Shown above: Example of a fake CAPTCHA/verification page generated in the Macfinger ClickFix campaign.

The Macfinger Domain and ClickFix Text

On Thursday 2026-09-24, the Macfinger domain for the fake verification page was hollow-badger-moasfraum[.]life. The clipboard-injected text was similar to what I reported in my previous diary, and I pasted it into a Terminal window.


Shown above: Clipboard-injected text from the Macfinger ClickFix campaign pasted in a Terminal window.

I saw the same message in my Terminal window after running the ClickFix text as the message noted in the Ransom-ISAC blog.


Shown above: Terminal window after running the ClickFix text.

Loader Activity

The ClickFix text retrieved a loader from hxxp[:]//45.131.215[.]56/8031e818c7a46?force=1. This loader is a shell script, and it saves a binary under the user's /Library/Caches/com.apple.securityd/ directory as com.apple.periodic.

If com.apple.periodic already exists and is running, the script will kill that running process.


Shown above: The initial downloaded shell script showing a location of a binary.

The script checks the system's architecture using uname -m and will download the appropriate payload depending on the architecture. Apple silicon is arm64, while systems using an Intel processor are x86_64. The corresponding URLs are:

  • arm64 Mach-O binary: hxxp[:]//45.131.215[.]56/a7a11f95?force=1
  • x86_64 Mach-O binary: hxxp[:]//45.131.215[.]56/4e04813226b1b93?force=1

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Isc.

Primary Advisory →