ClickFix Campaign Uses Spectrum-Themed Sites to Deliver AMOS to macOS Users

Summary

Researchers detail a ClickFix campaign using Spectrum lookalike sites to steal macOS passwords and deliver AMOS. The campaign later shifted to malvertising fake Homebrew repositories.

Key points

The sites used user-agent checks to deliver different commands; the macOS command downloaded and immediately ran a shell script.
The script repeatedly prompted for the system password, validated it with dscl, saved it to /tmp/.pass, and used it to remove quarantine before running the payload.
The downloaded malware was identified as an Atomic macOS Stealer (AMOS) variant.
After disclosure, the operators shifted to malicious ads for counterfeit Homebrew repositories; repository changes replaced older command-and-control infrastructure.
Russian-language source-code comments suggest Russian-speaking operators, while inconsistent platform instructions indicate poorly assembled delivery infrastructure.
The researchers recommend user awareness training, restricting unsigned scripts with Gatekeeper or MDM policies, and hunting for password-prompt abuse and unusual sudo activity.

Article Details

Attack Vectors: ClickFix delivery pages impersonating Spectrum used a clipboard-based command and instructions to persuade victims to execute it.
The delivery sites returned different commands based on the visitor's user agent: PowerShell for non-macOS users and a Bash command for macOS users.
The macOS script repeatedly prompted for the system password, validated it with dscl, saved it to /tmp/.pass, downloaded an AMOS payload, removed its quarantine attribute, and executed it.
The article reports that malicious advertisements for counterfeit Homebrew repositories were used to redirect developers to the attack.
Defensive Notes: Train users to recognize password-stealing tactics disguised as system verification prompts.
Enforce macOS endpoint hardening, including system integrity protections and restrictions on unsigned scripts through Gatekeeper and MDM policies.
Hunt for password-prompt abuse, unusual sudo activity, and the reported AMOS indicators.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`applemacios[.]com`	Command-and-control domain identified in the IOC table; hosted the reported macOS script and payload.
DOMAIN	`brewory[.]com`	Command-and-control domain identified in the IOC table.
DOMAIN	`cf-verifi[.]pages[.]dev`	Command-and-control domain identified in the IOC table; also served the reported Windows script.
DOMAIN	`homebrewrp[.]com`	Command-and-control domain identified in the IOC table.
DOMAIN	`panel-spectrum[.]net`	ClickFix delivery domain identified in the IOC table.
DOMAIN	`rugme[.]cat`	Listed as a ClickFix indicator of a future attack.
DOMAIN	`spectrum-ticket[.]net`	ClickFix delivery domain identified in the IOC table.
MD5	`6fd092d86235d7ae35c557523f493674`	MD5 hash identified as an AMOS variant.
MD5	`eaedee8fc9fe336bcde021bf243e332a`	MD5 hash identified as an AMOS variant.
URL	`hxxps[:]//applemacios[.]com/getrur/install[.]sh`	Malicious script URL used to deliver the macOS infection sequence.
URL	`hxxps[:]//applemacios[.]com/getrur/update`	Payload URL used by the macOS script to download the AMOS variant.
URL	`hxxps[:]//cf-verifi[.]pages[.]dev/i[.]txt`	Script download URL associated with the reported Windows delivery command.