Atomic Stealer

Anatomy of a macOS ClickFix Crimekit that Weaponises EtherHiding

Researchers reported multiple social-engineering campaigns targeting macOS users with fake CAPTCHA and ClickFix lures that trick victims into copying and pasting malicious commands into Terminal, shifting execution to the user and bypassing traditional app-download protections. One campaign delivered Atomic macOS Stealer (AMOS) through trojanized cracked applications and malicious Terminal instructions, stealing credentials, browser data, cryptocurrency wallets, Telegram data, VPN profiles, keychain contents, Apple Notes, and files from common user folders before compressing and exfiltrating them over HTTP/HTTPS. Trend Micro separately documented multistage fake CAPTCHA attacks that also led to infostealers and remote-access trojans, underscoring the broader use of human-verification themes to launch malware chains. A separate July 2026 macOS campaign used a fake TrustKey verification page on Cloudflare Pages, a Cloudflare Worker, and an AppleScript-based loader to install a persistent backdoor named bmodule via LaunchAgent persistence. The malware dynamically resolved live command-and-control infrastructure from a Polygon smart contract using an EtherHiding technique, then fingerprinted hosts, phished macOS login passwords, and fetched tasks to deploy AMOS variants, an interactive shell, or an XMRig cryptominer. Apple said macOS Sequoia has updated runtime protections, while incident reporting shows Terminal-based social-engineering chains remain effective because they rely on users to execute the malicious commands directly.

Fake Crypto Exec Used Booby-Trapped Google Doc to Target Security Researcher After DEF CON - IT Security Guru

A threat actor targeted security researchers after Black Hat and DEF CON by impersonating a senior CoinDesk-linked cryptocurrency media executive on X and sending conference-planning lures through trusted services including Google Docs, GitHub Releases, and Dropbox DocSend. Huntress reported that the first lure used a booby-trapped Google Doc with a malicious Google Apps Script sidebar that asked victims for an "encryption key," profiled the host, and then steered users into staged malware delivery paths tailored to macOS and Windows systems. On macOS, victims were served a disk image resembling Atomic macOS Stealer (AMOS), while Windows targets received a fake Google API Connector update that led to a ClickOnce application, PowerShell-based loaders, and additional payloads. Huntress said the Windows chain ultimately deployed NetSupport RAT, a fake Ledger wallet application, and a local TLS-intercepting proxy built around a rogue certificate authority, indicating goals that included credential theft, cryptocurrency wallet compromise, and persistent remote access; when the first attempt failed, the actor followed up with a second malicious document disguised as a DocSend share to continue the intrusion attempt.

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware | Huntress

An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via Cracked Apps | TrendAI (US)

Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer | TrendAI (US)

Researchers found widespread supply-chain abuse in the OpenClaw ClawHub skill marketplace, identifying 341 malicious skills among 2,857 reviewed. Most of the malicious listings were tied to a coordinated campaign dubbed ClawHavoc, which used polished documentation and fake prerequisite steps to trick users into installing malware. On macOS, the skills directed OpenClaw to fetch and run obfuscated shell scripts and a fake OpenClawCLI component that ultimately delivered Atomic macOS Stealer (AMOS) as a universal Mach-O binary for both Intel and Apple Silicon systems; on Windows, the campaign used password-protected ZIP archives. The activity was also observed across multiple skill repositories and websites, showing that attackers are using AI agent workflows as a new malware delivery channel rather than relying only on direct user lures. The AMOS payloads were reported to steal credentials, keychain contents, browser data, crypto-wallet information, Telegram sessions, Apple Notes, and files from common user directories before exfiltrating the data to attacker-controlled infrastructure. Researchers also found six additional malicious outlier skills using different techniques, including Polymarket-themed skills that embedded reverse-shell backdoors in otherwise normal code and another skill that sent a bot configuration file to a webhook. Koi Security said it reported the malicious skill list to ClawHub’s security team and released a defensive scanning skill, Clawdex, to help detect flagged skills before or after installation.

Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

Microsoft reported that a macOS-focused ClickFix campaign evolved from openly serving fake download pages to using server-side browser fingerprinting that shows the malicious lure mainly to likely macOS victims. The operation used more than 250 look-alike domains, often following dictionary-style naming patterns that included the token file, and presented spoofed GitHub-themed pages with a fake Download for macOS prompt. Victims were tricked into pasting a Terminal command that fetched remote scripts and installed infostealers including Atomic Stealer (AMOS) and MacSync. The gating logic collected browser, hardware, and anti-analysis signals before deciding whether to deliver the lure, including navigator data, WebGL GPU details, timezone, iframe status, touch support, console serialization behavior, and prototype-tamper checks; non-qualifying visitors were sent blank or benign decoy pages. Separate IOC material tied the same broader activity to additional macOS infostealer infrastructure, including SHub Stealer, suspected delivery and command-and-control domains, a SHA-256 sample hash, and capabilities such as screenshot capture, file download, command execution, and self-deletion, reinforcing that the campaign relied on rotating lure domains and stealthy staging to target macOS users.

From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide | Microsoft Security Blog

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft - Malware News - Malware Analysis, News and Indicators

Microsoft reported that social-engineering lures are increasingly being used to trick users into launching malware themselves, with the ClickFix technique emerging as a major delivery method across phishing, malvertising, and compromised websites. In ClickFix attacks, victims are shown fake CAPTCHA, verification, or repair prompts that copy malicious commands to the clipboard and persuade them to run them, often leading to fileless execution through LOLBins, obfuscated PowerShell, and follow-on payloads such as Lumma Stealer, DarkGate, Latrodectus, ScreenConnect, and AMOS. Microsoft said the technique has hit thousands of enterprise and consumer devices daily and is now supported by a growing underground market of ClickFix builder kits sold on criminal forums. Fresh activity shows the tactic continuing to evolve. A SmartApeSG campaign observed on compromised web traffic redirected victims to a fake human-verification flow that fetched an HTA downloader from deltaode[.]com, retrieved a ZIP archive, and abused DLL side-loading to launch an unidentified RAT that later communicated with 89.124.79[.]98 over TCP 443. Separately, Microsoft linked the CaptiveCrunch campaign to Storm-2945, a sub-cluster of Russia-linked Midnight Blizzard, which has manipulated DNS and HTTP traffic on hospitality and other captive-portal networks to redirect travelers to phishing pages and fake browser or OS updates delivering CornFlake and ChocoShell for credential theft and espionage, including theft of browser credentials, Microsoft 365 tokens, and Wi-Fi credentials.