ClickFix campaign delivers macOS infostealer via DMG

A new macOS ClickFix campaign employs fake CAPTCHA pages to deceive users into executing malicious Terminal commands. The attack chain downloads and invisibly mounts a DMG file containing a self-signed information-stealer application bundle. This payload, assessed as belonging to the AMOS (Atomic macOS Stealer) lineage—specifically the Odyssey variant—prompts users for passwords through fake System Preferences dialogs. The stealer harvests extensive data including browser credentials, cryptocurrency wallet information from 13 standalone applications and 201 browser extensions, messaging app data, Apple Notes, Safari cookies, and macOS keychain entries. Exfiltrated data is compressed and sent to two command-and-control servers. The malware establishes persistence via LaunchAgent and trojanizes legitimate cryptocurrency applications including Ledger Live and Trezor Suite, replacing them with compromised versions downloaded from attacker infrastructure.

• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05
• The Psychedelic Stealer: When the CAPTCHA Is the InstallerMalware2026-10-02
• RARLAB WinRAR · Gorbag: Orcs at the border harvesting intelligence from UkraineExploitedMalware2026-11-03
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• September 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-30