Introduction to ClickFix Attack
A recently discovered macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files, infecting Mac devices with the Atomic macOS Stealer (AMOS) infostealer.
The campaign, first discovered by researchers at Palo Alto Networks Unit 42, begins with a fake CAPTCHA page that instructs users to open Terminal and paste a malicious command to verify themselves.
How the Attack Works
Once the command is executed, it downloads a DMG file from an attacker-controlled server, silently mounts it using macOS's native hdiutil utility, locates the application bundle it contains, and launches it automatically.
The malicious Terminal command used as fake Captcha verification downloads a malicious DMG from svs-verificationdate[.]beer using curl with the quiet "-fsSL" flags and saves it to the /tmp folder under a random filename.
The command then executes 'hdiutil attach -nobrowse' to mount the downloaded disk image without displaying it in Finder or on the desktop.
Malware Delivery and Execution
The script then searches up to three directory levels deep for the first available .app or .pkg installer, and if one is found, launches it using the macOS open command.
Researchers observed the malware being delivered as a disk image named "s.01M0td.dmg," which mounted a volume containing a self-signed application bundle named "NNApp.app."
This payload is part of the Atomic macOS Stealer family, which is used to steal credentials, browser history, authentication tokens, and cryptocurrency wallets from infected devices.
Targeted Data and Malware Capabilities
The stealer will display a fake System Preferences authentication prompt that asks the user to enter their password, allowing the malware to steal it.
According to the researchers, the malware targets eight Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Arc, Vivaldi, CocCoc, and Yandex, stealing cookies, login databases, autofill information, stored payment cards, and browser profile data.
The stealer also targets Firefox-derived browsers, including LibreWolf, SeaMonkey, Tor Browser, Waterfox, and Zen Browser, stealing the same information.
Palo Alto says the malware searches for and steals cryptocurrency wallet data, including Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, DashCore, Guarda, Binance Wallet, Dogecoin Wallet, and TonKeeper.
The malware also steals Telegram Desktop and Discord data, Apple Notes databases, Safari cookies, Apple Keychain database files, and user documents with the PDF, TXT, or RTF extensions.
Data Exfiltration and Command-and-Control Servers
All harvested data is then stored in a ZIP archive and uploaded to the attacker's server, where the attacker can retrieve it.
The campaign was observed using command-and-control servers at svs-verificationdate[.]beer and 196.251.107[.]171.
Conclusion and Recommendations
Users should always be cautious when websites instruct them to open Terminal and execute commands, especially when they claim to be part of CAPTCHA verifications, browser fixes, or other troubleshooting steps.
If you do not 100% understand what a command does, do not run it.
Security teams should prioritize educating users about the risks of social engineering attacks and implementing robust security measures to detect and prevent such threats.
- Be cautious when executing Terminal commands from untrusted sources.
- Verify the authenticity of CAPTCHA pages and browser error messages.
- Keep software and operating systems up to date with the latest security patches.
Test every layer before attackers do. Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
Source: BleepingComputer