Fake macOS Toolkit Site Uses ClickFix Tactic to Deploy AMOS Stealer

Palo Alto Networks’ Unit 42 has analysed an Atomic macOS (AMOS) stealer infection created in a laboratory on 5 August 2026. The infection began on a website, getmacouscloud[.]com, that claimed to provide instructions for installing a “macOS toolkit”. Users were told to copy text into Terminal. That command downloaded a Z-shell script containing a Base64-encoded, GZIP-compressed payload, which then retrieved and ran a Mach-O installer.

Unit 42 said this copy-and-paste method is sometimes labelled ClickFix, although it does not use the fake CAPTCHA workflow typically associated with that technique.

The installer created files in hidden-looking directories under the user’s Library, including binaries named AccountsHelper and mdworker_shared, with shell scripts used to run them. The infection requested the user’s password and several permissions, including control of Finder and Notes and access to Desktop and Documents. In the lab, AMOS collected data into a temporary out.zip archive containing material associated with cryptocurrency wallets, AWS, Docker, FileZilla, Google Cloud, Telegram and zsh history.

The researchers stressed that the test host had no additional applications, so these contents indicated what the malware searched for rather than confirmed data from installed software.

Post-infection traffic mainly used HTTP POST requests to 161.35.146[.]120, with stages suggesting collection from messengers, credentials, browsers, wallets and local data. A 31 July infection used a different server, 188.166.78[.]138. Unit 42 said domains, addresses, filenames, hashes and paths change frequently, indicating an actively developing malware family; the published indicators are therefore only a snapshot.