A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)

Reporting by SANS Internet Storm CenterRead the original at isc.sans.edu

Executive Summary

The investigation details an infection from the Macfinger ClickFix campaign occurring on Thursday, September 24, 2026, on a physical host running macOS 27.0 (Golden Gate). The initial phase involved accessing a fake verification page hosted on hollow-badger-moasfraum[.]life, from which clipboard-injected text was pasted into the Terminal to retrieve a loader script. This script downloaded an executable payload based on the system's architecture, downloading either an arm64 or x8664 Mach-O binary from a specified host. The process involved reporting activity to a Command and Control (C2) server using URL patterns that included `/api/t` and websocket traffic for communication. Post-infection activity included data exfiltration via HTTP POST requests targeting `/api/credentials`, `/api/shell/agent`, and `/api/t`. The malware requested access permissions, including accessing files in the Documents, Desktop, Downloads folders, and media libraries, ultimately requesting administrator and macOS Keychain passwords. Persistence was established via a LaunchAgent file, which executed copies of the downloaded binaries located in system caches directories.

Facts Only

* Infection occurred on Thursday, 2026-09-24, on a physical host running macOS 27.0 (Golden Gate).
* A fake verification page was hosted on hollow-badger-moasfraum[.]life.
* Clipboard-injected text was used in Terminal to initiate the process.
* A loader script was retrieved from hxxp[:]//45.131.215[.]56/8031e818c7a46?force=1.
* The loader downloaded a payload based on system architecture, with specific URLs provided for arm64 and x8664 Mach-O binaries.
* A C2 server URL was derived from base64 text: hxxp[:]//95.163.153[.]80:8133/api/t.
* Post-infection C2 traffic included websocket communication and HTTP POST requests to /api/credentials, /api/shell/agent, and /api/t for data exfiltration.
* The malware requested access to folders, applications, and subsequently prompted for administrator and macOS Keychain passwords.
* Persistence was established via /Users/[username]/Library/LaunchAgents/com.apple.softwareupdated.plist, running binaries from /Users/[username]/Library/Caches/com.apple.softwareupdate/SoftwareUpdate.
* Specific SHA-256 hashes were recorded for the loader and various downloaded/persistent binary files.

Full Take

The narrative shifts focus from identifying a specific malware family like AMOS Stealer to cataloging novel infection methods used by the Macfinger ClickFix campaign, emphasizing behavioral differences over known signatures. The method relies on exploiting user interaction (clipboard injection) to execute a multi-stage downloader that dynamically selects payloads based on the host architecture. The post-exploitation phase is characterized by layered exfiltration methods—using both standard HTTP POST requests for credentials and a shift to websocket traffic for command and control, indicating an attempt to evade simple network monitoring. Furthermore, the demand for specific application access and password material reveals a focus on deep system reconnaissance and credential harvesting capabilities beyond typical file access. The proliferation of slightly different binary versions with minor hash variations suggests an adaptive persistence mechanism designed to avoid static signature detection by focusing on dynamic execution artifacts rather than immutable file hashes. This pattern implies that actors are prioritizing stealth through polymorphism in their payloads while maintaining consistent C2 communication patterns, forcing analysts to focus not just on *what* the malware steals, but *how* it adapts its delivery and communication channels across different environments.
Bridge Questions:
What are the security implications of using dynamic architecture-dependent downloads for payload delivery? How does the observed shift from standard HTTP POSTs to websocket traffic reflect an evolving adversary strategy in macOS environments? What methodologies can be developed to detect polymorphic persistence mechanisms that rely on system utility launches rather than static file placement?

From the original · SANS Internet Storm Center

A Closer Look at Malware From the Macfinger ClickFix Campaign Introduction My previous post on Macfinger ClickFix was two days ago, and this campaign remains active. The more I look into the malware delivered by this campaign, the more I believe it is not a variant of Atomic macOS (AMOS) Stealer as originally reported.

Read the full story at isc.sans.edu

Sentinel — Human

Confidence

This text reads like a detailed, firsthand forensic report blending personal investigative conclusions with concrete technical artifacts from malware analysis.

Signals Detected

Erratic sentence length and distinct, highly technical focus; use of personal qualifiers ('I believe', 'I just don't know') suggests a specific authorial voice.

Strong internal narrative flow linking observational steps (domain, loader, C2 traffic, persistence) with technical evidence, driven by personal investigative experience.

The structure is highly deductive, following a step-by-step forensic narrative rather than synthesizing external arguments.

Specific file paths, SHA-256 hashes, and URL structures are presented as direct findings from an observed infection process, lending high specificity to the claims.

Human Indicators

Use of first-person narrative ('My previous post', 'I believe', 'I don't know') establishes a subjective investigative presence.

The text mixes high-level analysis (distinguishing malware variants) with extremely granular, empirical data (specific file hashes, C2 IPs, and process interactions), characteristic of deep forensic reporting.

The expression of uncertainty ('I still don't know what to call it') introduces a human element of intellectual humility and active investigation.