Mac users have long operated under the assumption that their platform offers a meaningful security advantage over Windows. That assumption is eroding fast. A newly observed social engineering campaign is exploiting macOS's own native utilities to silently install credential-stealing malware — and the entry point is nothing more than a fake CAPTCHA page and a willing user.

Threat Alert: Mac users have long operated under the assumption that their platform offers a meaningful security advantage over Windows.

How the Attack Unfolds

The campaign follows the now-familiar ClickFix playbook, a technique that has surged in adoption among both financially motivated cybercriminals and state-sponsored threat actors over the past year. Victims encounter a convincing fake CAPTCHA or browser verification prompt that instructs them to open Terminal and paste a command to "prove they're human." What they're actually pasting is the first stage of a multi-step malware delivery chain.

Once that command executes, the attack proceeds with surgical efficiency:

How the Attack Unfolds
A malicious DMG file is silently fetched from an attacker-controlled server using curl with quiet flags designed to suppress any visible output, and saved to the /tmp directory under a randomized filename.
The native macOS hdiutil attach -nobrowse utility mounts the disk image without surfacing it in Finder or on the desktop — giving the user no visual indication that anything has happened.
The script then recursively searches up to three directory levels deep within the mounted volume for any .app bundle or .pkg installer, and launches the first match using the macOS open command.

What makes this iteration particularly noteworthy is the combination of approaches. Earlier ClickFix campaigns that used DMG files still required users to manually open the downloaded image and interact with its contents. This campaign eliminates that friction entirely — the malware launches itself.

The Payload: Atomic macOS Stealer

The delivered payload belongs to the Atomic macOS Stealer (AMOS) family, a well-documented infostealer sold as a commercial crimeware tool. Its data collection scope is broad and deliberate.

Upon execution, the malware presents a convincing fake System Preferences authentication dialog, harvesting the user's macOS password. From there, it moves systematically through the system:

  • Browsers: Targets at least eight Chromium-based browsers — including Chrome, Edge, Brave, Opera, Arc, Vivaldi, CocCoc, and Yandex — as well as Firefox-derived browsers such as LibreWolf, Waterfox, Tor Browser, SeaMonkey, and Zen Browser. Stolen data includes cookies, saved passwords, autofill entries, stored payment card details, and full browser profiles.
  • Cryptocurrency: Actively hunts for wallet data from more than a dozen platforms including Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, Guarda, Binance Wallet, Dogecoin Wallet, and TonKeeper.
  • System and messaging data: Exfiltrates Apple Keychain database files, Safari cookies, Apple Notes databases, and data from Telegram Desktop and Discord.
  • Documents: Scans for and steals user files with PDF, TXT, and RTF extensions.

All harvested data is compressed into a ZIP archive and transmitted to attacker-controlled infrastructure — in this campaign, identified servers include a domain ending in .beer and a dedicated IP address.

Perhaps the most alarming capability observed: the malware actively replaces legitimate installations of Ledger Live and Trezor Suite with trojanized versions — a technique designed to intercept cryptocurrency transactions and drain hardware wallet users who believe they are operating in a trusted environment.

Why This Technique Is Gaining Traction

ClickFix's effectiveness lies in its exploitation of trust and urgency. Users encountering a "verification required" message on a site they're actively trying to access are primed to comply with instructions — especially when those instructions are dressed up in the language of routine IT troubleshooting. The technique bypasses browser-level download warnings and endpoint detection that looks for suspicious file execution patterns, because the user themselves initiates the chain.

On macOS specifically, the abuse of hdiutil is particularly clever. It's a legitimate system utility with no inherent reason to trigger security alerts. By routing malware delivery through trusted native tooling, attackers reduce the likelihood of behavioral detection while keeping the attack chain simple and reliable.

The fact that ClickFix has now been adopted by nation-state actors in addition to criminal groups signals that this isn't a passing trend — it's an established and evolving technique that defenders need to account for across their entire user base, not just high-risk segments.

What You Should Do

For Individual Users

  • Never execute Terminal commands prompted by a website. No legitimate service — CAPTCHA provider, browser, or SaaS platform — will ever require you to open Terminal and paste commands to verify your identity.
  • Treat clipboard content as untrusted. If a site asks you to copy something and paste it into Terminal, that is a social engineering attack. Close the tab.
  • Audit installed applications regularly. Verify the integrity of cryptocurrency management software like Ledger Live or Trezor Suite by downloading directly from official sources and checking cryptographic signatures.
  • Enable macOS Gatekeeper and keep it enforced. While this campaign uses a self-signed application bundle, Gatekeeper prompts remain a meaningful speed bump — do not dismiss security warnings reflexively.

For Security Teams

  • Monitor for suspicious hdiutil usage. Legitimate user workflows rarely involve programmatic, non-interactive disk image mounting. Flag hdiutil attach -nobrowse invocations originating from shell sessions for investigation.
  • Deploy endpoint detection rules for /tmp DMG activity. Writing and mounting disk images from the temp directory is a strong behavioral indicator of this attack pattern.
  • User awareness training should explicitly cover ClickFix scenarios. Show employees examples of fake CAPTCHA pages and browser error lures — familiarity with the visual pattern is one of the most effective defenses available.
  • Evaluate macOS EDR coverage gaps. Many enterprise endpoint tools remain less mature on macOS than on Windows. This campaign is a timely reminder to test detection coverage against macOS-specific attack chains.

The macOS threat landscape is no longer a secondary concern. As the platform's enterprise adoption grows, so does attacker investment in macOS-native techniques. This campaign demonstrates that sophisticated, multi-stage malware delivery is fully operational on Apple hardware — and that the human layer remains the most reliable attack surface of all.