New macOS ClickFix Campaign Uses Script Editor to Deliver Atomic Stealer
Summary
Jamf researchers observed fake Apple-themed sites using applescript:// links to launch Script Editor with malicious code that downloads Atomic Stealer, which targets Keychain data, passwords, cookies, browser wallets and other system information.
Key points
- Fake Apple-themed cleanup sites use applescript:// links to open Script Editor with pre-filled malicious code.
- The code runs an obfuscated curl | zsh command that downloads and executes a script in memory.
- The script decodes a base64 and gzip payload, downloads a Mach-O binary to /tmp/helper, removes security attributes, and runs it.
- Researchers identified the payload as Atomic Stealer, also known as AMOS.
- The malware targets Keychain data, browser wallet extensions, autofill data, passwords, cookies, stored credit cards and system information.
- The Script Editor variant avoids requiring users to manually run commands in Terminal; the article advises treating unexpected Script Editor prompts as high-risk.
Article Details
- Event Type
- macOS malware distribution campaign using a ClickFix variation
- Impact
- The campaign uses fake Apple-themed sites and malicious applescript:// links to deliver Atomic Stealer (AMOS). The malware targets Keychain items, browser wallet extensions, autofill data, passwords, cookies, stored credit cards, and system information. The article does not report the number of affected systems.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaign uses an obfuscated command and a base64- and gzip-encoded payload.T1059.002 · AppleScriptAttackers use applescript:// links to open Script Editor with pre-filled malicious script code.T1059.004 · Unix ShellThe obfuscated command uses curl and zsh to download and execute a script.T1105 · Ingress Tool TransferThe script downloads the malware payload, including a binary saved as /tmp/helper.T1555.001 · KeychainAtomic Stealer targets information stored in the macOS Keychain.T1555.003 · Credentials from Web BrowsersAtomic Stealer targets browser passwords and autofill data.
Malware
Atomic macOS Stealer (AMOS)The final payload is a Mach-O binary (Atomic Stealer/AMOS) that exfiltrates Keychain data, browser wallets, autofill data, passwords, cookies, and system information.Atomic StealerResearchers observed a new campaign delivering the Atomic Stealer to macOS users by abusing the built-in Script Editor via applescript:// links that open pre-filled malicious code.
Products
macOSResearchers observed a new campaign delivering the Atomic Stealer to macOS users by abusing the built-in Script Editor via applescript:// links that open pre-filled malicious code.Script EditorResearchers observed a new campaign delivering the Atomic Stealer to macOS users by abusing the built-in Script Editor via applescript:// links that open pre-filled malicious code.