Macfinger ClickFix campaign, (Tue, Sep 22nd)
Source SANS ISC Handlers Diary
Description
Introduction
Impact
Successful exploitation results in macOS hosts being infected with a variant of the AMOS Stealer malware, which can steal user credentials and other sensitive information. The campaign uses social engineering to trick users into executing malicious code, leading to potential data compromise and persistent infection. The malware communicates with attacker-controlled servers to report user data and receive commands, enabling ongoing control and data theft.
Defensive guidance
Mitigation focuses on user awareness to avoid following suspicious instructions on websites, blocking known malicious domains and IP addresses associated with the campaign, and employing endpoint protection solutions capable of detecting and preventing the AMOS Stealer malware. Refer to guidance from the Microsoft Security Blog for specific recommendations against ClickFix campaigns. Monitoring and filtering network traffic to the identified malicious domains can also reduce risk.
Summary
The Macfinger ClickFix campaign involves the injection of malicious scripts into legitimate websites to target macOS users through a fingerprinting technique. Victims are presented with fake bot protection pages prompting them to follow social engineering instructions, leading to the download and execution of a shell script and subsequent macOS Mach-O executables (both arm64 and x86_64 architectures). The malware variant is related to the AMOS Stealer family but differs from previously reported variants. Post-infection traffic includes frequent HTTPS POST requests to attacker-controlled domains for user tracking and data exfiltration. Indicators include specific malicious domains and IP addresses used for hosting and command and control.