macOS ClickFix Campaign Uses Silently Mounted DMGs to Install AMOS Stealer
Summary
Palo Alto Networks Unit 42 reports a macOS ClickFix campaign that tricks users into running Terminal commands to download and mount a DMG installing AMOS, which targets credentials, wallet data, Keychain files, messages, and documents.
Key points
- Fake CAPTCHA pages instruct Mac users to paste attacker-supplied commands into Terminal.
- The command quietly downloads a DMG from svs-verificationdate[.]beer, mounts it with macOS hdiutil, and launches an app or installer.
- The payload is Atomic macOS Stealer (AMOS); researchers say it can prompt users for their system password.
- AMOS targets browser credentials and data, cryptocurrency wallets, Telegram and Discord data, Apple Notes, Safari cookies, Keychain files, and documents.
- Harvested data is packaged into a ZIP archive and uploaded to an attacker-controlled server.
- Researchers observed the malware replacing legitimate Ledger Live and Trezor Suite installations with malicious versions, likely to facilitate crypto theft.
Article Details
- Event Type
- macOS ClickFix malware-distribution campaign using fake CAPTCHA pages and Terminal commands to deliver Atomic macOS Stealer (AMOS).
- Impact
- The malware steals browser credentials and data, cryptocurrency wallet data, Keychain files, messaging-app data, and documents. Stolen data is packaged in a ZIP archive and uploaded to attacker-controlled servers. Researchers also observed it replacing legitimate Ledger Live and Trezor Suite installations with malicious versions, likely for cryptocurrency theft.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | svs-verificationdate[.]beer | Attacker-controlled domain used to deliver the malicious DMG and identified as a command-and-control server. |
| IPV4 | 196[.]251[.]107[.]171 | Identified as a command-and-control server used by the campaign. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe ZIP archive containing stolen data is uploaded to an attacker-controlled server.T1059.004 · Unix ShellThe attack uses a Terminal command to download and launch the malicious application.T1105 · Ingress Tool TransferThe command downloads a malicious DMG from an attacker-controlled server.T1204.004 · Malicious Copy and PasteFake CAPTCHA instructions trick users into copying and executing an attacker-supplied Terminal command.T1555.001 · KeychainAMOS steals Apple Keychain database files from infected devices.T1560.001 · Archive via UtilityHarvested data is packaged into a ZIP archive before upload.
Malware
Products
Ledger LiveOf particular interest, the researchers found that the malware will replace legitimate installations of Ledger Live and Trezor Suite with malicious versions, likely to perform crypto theft.macOSA new macOS ClickFix campaign uses fake CAPTCHA pages and Terminal commands to silently download and launch a malicious DMG that installs Atomic macOS Stealer (AMOS).Trezor SuiteOf particular interest, the researchers found that the malware will replace legitimate installations of Ledger Live and Trezor Suite with malicious versions, likely to perform crypto theft.