The newly documented Macfinger ClickFix campaign is a useful reminder that macOS users are increasingly being targeted through attack chains designed specifically around user behavior rather than traditional software exploitation.

According to SANS Internet Storm Center researcher Brad Duncan, the campaign uses legitimate websites that have been injected with malicious JavaScript. When a visitor reaches one of these compromised sites, the injected script can fingerprint the environment and display a fake bot-protection or verification page tailored to macOS users.

The victim is then presented with ClickFix-style instructions designed to convince them to manually execute attacker-supplied commands.

That distinction matters.

The attacker is not necessarily exploiting a vulnerability in macOS itself. Instead, the campaign attempts to persuade the user to become part of the execution chain.

The attack starts from a legitimate website

One of the most dangerous aspects of this campaign is that users may initially visit a genuine website.

SANS observed multiple legitimate sites containing injected malicious script associated with the campaign. The script redirects the victim into a fake verification workflow that resembles bot-protection or anti-automation challenges.

This undermines one of the security habits users often rely on:

“I recognize the website, so the page must be safe.”

That assumption does not hold when a legitimate site has been compromised.

An attacker does not always need to register an obviously suspicious domain and convince users to visit it directly. Compromising trusted websites allows malicious content to inherit some of the site's credibility.

ClickFix turns the victim into the execution mechanism

ClickFix attacks rely heavily on psychology.

Instead of automatically executing malware, the malicious page gives the user instructions that appear to solve a technical problem, complete a verification process, or prove that they are human.

The victim is effectively encouraged to copy, paste, or execute a command that initiates the infection.

This approach can bypass some conventional security controls because the action is performed through legitimate operating-system tools with explicit user involvement.

From a defender's perspective, this means that simply blocking malicious attachments is not enough.

A user may receive no attachment at all.

The infection can begin entirely inside the browser and continue through the command line.

The campaign appears specifically designed for macOS

SANS describes the activity as a campaign that fingerprints the victim environment and targets macOS systems.

This is important because attackers increasingly adapt their infrastructure to the operating system they detect.

Historically, many users perceived macOS as less exposed to malware than Windows.

While macOS includes strong built-in security mechanisms, attackers do not necessarily need to defeat those mechanisms directly if they can convince the user to authorize or execute malicious activity.

Macfinger demonstrates this clearly.

The attack is designed around the assumption that the target is using a Mac and delivers macOS-compatible payloads accordingly.

SANS identified follow-up malware in both:

  • ARM64 format, suitable for Apple Silicon systems; and
  • x86_64 format, suitable for Intel-based Macs.

That indicates the campaign operators are attempting to support a broad range of macOS hardware rather than targeting a narrow subset of devices.

The malware delivery chain is straightforward but effective

SANS observed an initial Bourne-Again shell script being retrieved from attacker infrastructure.

That script subsequently downloaded additional Mach-O executables corresponding to the victim system architecture.

This is a particularly relevant detection opportunity.

Organizations monitoring macOS endpoints should pay attention to situations in which:

  • a browser leads to command-line execution;
  • a shell process downloads executable content;
  • curl, shell scripts, or similar tools retrieve files from unfamiliar external IP addresses;
  • newly downloaded Mach-O files are executed shortly afterwards; or
  • command-line activity follows visits to unusual verification pages.

No single event necessarily proves malicious activity.

The combination, however, can be highly suspicious.

The campaign also tracks victim interaction in real time

An interesting element in SANS's traffic analysis is that the malicious infrastructure receives repeated HTTPS POST requests while the fake verification page is displayed.

These requests report information about the victim and appear to track user actions.

SANS observed POST traffic even in a test where the user eventually abandoned the page rather than completing the instructions.

This indicates that the campaign infrastructure is doing more than simply serving a static malicious page.

It appears capable of monitoring how users interact with the lure.

That can potentially help attackers measure conversion rates, determine where users abandon the infection flow, or adapt their social-engineering techniques.

It is effectively telemetry for malware delivery.

Cybercriminals, apparently dissatisfied with stealing credentials, have also discovered product analytics.

Post-infection traffic reveals credential-stealing behavior

SANS documented subsequent command-and-control traffic involving:

95.163.153[.]80

over TCP port:

8133

The observed requests included paths such as:

/api/t

/api/shell/agent

and notably:

/api/credentials

Repeated POST requests to the credentials endpoint strongly support the assessment that the malware is collecting and transmitting credential-related information.

SANS notes that a prior Ransom-ISAC analysis identifies the final malware as a variant of Atomic macOS Stealer, or AMOS.

However, Duncan also points out that the indicators do not fully align with AMOS activity he previously analyzed, suggesting this may represent a different variant or operational branch.

That nuance is important.

Malware families evolve.

Defenders should avoid relying exclusively on one historical fingerprint or fixed IOC set simply because an infection has been assigned a familiar family name.

Why Atomic macOS Stealer is particularly concerning

AMOS is associated with information-stealing activity against macOS systems.

Infostealers generally seek data that can be monetized or used to facilitate additional attacks.

Depending on the malware variant and system configuration, potential targets can include:

  • browser-stored credentials;
  • authentication cookies;
  • session tokens;
  • cryptocurrency wallet information;
  • local files;
  • system information; and
  • other account credentials.

The theft of session cookies and tokens is particularly important because an attacker may sometimes be able to reuse an authenticated session without first knowing the user's password.

This means that even accounts protected by multi-factor authentication can potentially remain at risk if an attacker successfully steals and reuses valid session material.

Legitimate websites create a difficult security problem

The compromised-site component makes this campaign more challenging than ordinary phishing.

Organizations frequently use domain reputation as part of web-security decisions.

If a domain has existed for many years and normally hosts legitimate content, it may have a good reputation.

But reputation is not the same as current integrity.

A trusted website can still be compromised today.

That means web security controls need to examine not only which domain a user visits, but also:

  • what scripts the page loads;
  • where those scripts originate;
  • whether the page suddenly communicates with newly registered domains;
  • whether browser activity leads to command-line execution; and
  • whether subsequent connections match known malicious infrastructure.

The security decision should be based on behavior and context, not merely domain age or reputation.

Indicators from the observed campaign

SANS documented the following attacker infrastructure during its September 22 observations:

Injected-script and tracking domain

velvet-otter-glagceis[.]life

Payload infrastructure

45.150.33[.]128

Post-infection command-and-control

95.163.153[.]80:8133

SANS also published SHA-256 hashes for the observed initial shell script and the subsequent ARM64 and x86_64 Mach-O payloads.

These indicators provide immediate hunting opportunities.

However, they should be treated as temporary indicators rather than permanent detection rules.

Attackers can change domains, IP addresses, filenames, and hashes extremely quickly.

Behavioral detection is more valuable than IOC matching alone

The stronger detection strategy is to understand the chain:

legitimate website → injected JavaScript → fake bot verification → user follows ClickFix instructions → shell execution → external download → Mach-O payload → outbound C2 → credential exfiltration

Security teams should create detections around the transitions between those stages.

For example:

  • browser activity immediately followed by shell execution;
  • unusual shell commands pasted by users;
  • shell processes downloading binaries from raw IP addresses;
  • execution of newly downloaded Mach-O files;
  • unexpected outbound traffic over unusual ports such as TCP 8133;
  • repeated credential-related HTTP POST activity; and
  • processes attempting to access browser credential stores or other sensitive locations.

These behaviors remain useful even if the attacker replaces every published IOC tomorrow.

Organizations should reconsider how they train users

Traditional security awareness frequently teaches users:

“Do not click suspicious links.”

That advice is increasingly incomplete.

ClickFix attacks often require the user to do something that feels technical and legitimate:

  • open Terminal;
  • launch PowerShell;
  • paste a command;
  • run a verification script; or
  • execute something supposedly required to fix an error.

Security training should therefore include a much simpler rule:

A website should never need you to open Terminal or a command prompt and paste a command merely to verify that you are human.

That message is easier for ordinary users to remember than explaining every possible ClickFix variant.

macOS endpoints need the same level of enterprise monitoring as Windows

The campaign also reinforces a broader issue.

Some organizations still apply significantly more endpoint monitoring and malware detection to Windows systems than to Macs.

That assumption is becoming increasingly difficult to justify.

Attackers now develop malware specifically for:

  • Apple Silicon;
  • Intel Macs;
  • browser credential stores;
  • macOS authentication data; and
  • cryptocurrency and developer environments commonly used on Macs.

Organizations using macOS should therefore ensure they have:

  • endpoint detection and response coverage;
  • command-line telemetry;
  • DNS monitoring;
  • web filtering;
  • outbound connection monitoring;
  • application control where appropriate; and
  • centralized logging.

A Mac used by an executive, developer, administrator, researcher, or finance employee can contain highly valuable credentials regardless of the operating system logo on the lid.

Website owners also have a role in preventing these attacks

The victims in this campaign are not limited to the end users who receive the malware.

Owners of legitimate websites whose pages have been injected with malicious JavaScript are also part of the attack chain.

Website administrators should therefore monitor for:

  • unauthorized changes to JavaScript files;
  • modifications to templates and CMS plugins;
  • newly inserted external scripts;
  • suspicious administrator accounts;
  • unauthorized file modifications; and
  • unexpected outbound references in website source code.

Content Security Policy can also help reduce the ability of injected scripts to load resources from arbitrary external domains, although its effectiveness depends heavily on how strictly it is configured.

The broader cybersecurity lesson

Macfinger ClickFix demonstrates how malware delivery is moving away from obvious malicious files and toward multi-stage social engineering that abuses trusted websites and legitimate operating-system functionality.

The attacker does not necessarily need to discover a zero-day vulnerability.

Instead, the attacker compromises one website and convinces the victim to perform the crucial execution step.

The browser provides trust.

The fake verification page provides urgency.

The victim provides execution.

The shell downloads the malware.

The infostealer collects the credentials.

From an attacker's perspective, this is depressingly efficient.

The key defensive lesson is therefore not simply to block the currently published Macfinger infrastructure.

Organizations need visibility across the entire chain.

When a trusted website suddenly asks a user to execute a command, trust in the website should end immediately.

The Macfinger campaign demonstrates that macOS security increasingly depends not only on preventing malicious binaries from executing, but also on detecting when social engineering persuades legitimate users and legitimate system tools to execute them on the attacker's behalf.

Introduction

Source: Macfinger ClickFix campaign, (Tue, Sep 22nd) via SANS Internet Storm Center — published 23 Sep 2026.