THE Macfinger ClickFix campaign remains active and is delivering an unidentified macOS information stealer, according to SANS Internet Storm Centre researcher Brad Duncan. In an infection observed on 24 September 2026 on macOS 27.0, victims were shown a fake CAPTCHA page that placed commands in the clipboard. Pasting those commands into Terminal downloaded a shell-script loader, which saved malware as `com.apple.periodic` under the user’s cache directory. The loader detected whether the host used arm64 or x86_64 and retrieved a matching Mach-O binary.
Duncan said the malware was initially reported as Atomic macOS (AMOS) Stealer, but its data collection, exfiltration, persistence and binary architecture differ from recent AMOS activity, so that attribution remains unconfirmed. Network evidence showed the infected host reporting download and execution status to a command-and-control server, then using both HTTP POST requests and WebSocket traffic. Data was sent to `/api/credentials`. The malware also prompted for access to Notes, Documents, Desktop, Downloads, media and photo libraries, as well as administrator and Keychain passwords.
Persistence was established through `/Users/[username]/Library/LaunchAgents/com.apple.softwareupdated.plist`, which launched a copy stored as `SoftwareUpdate` in the user’s cache. The report provides hashes, file paths, the observed fake-verification domain, malware-hosting URLs and C2 endpoints for investigation and detection. A packet capture and malware samples are also available from Malware-Traffic-Analysis.net.