Macfinger ClickFix campaign

Summary

A new social engineering campaign tracked as Macfinger ClickFix targets macOS users by injecting malicious scripts into legitimate websites. The attack presents fake bot protection pages that trick victims into executing commands that download macOS-specific malware. The payload appears to be a variant of the Atomic macOS Stealer (AMOS) designed to steal credentials and other user information.

Investigation

The investigation identified legitimate websites compromised with injected scripts that display fake verification pop-ups. Network traffic analysis revealed a dedicated domain used for user tracking, along with several IP addresses supporting malware delivery and Command and Control (C2) communications. Observed traffic patterns indicate credential and system information exfiltration through HTTP POST requests.

Mitigation

Users should be trained to avoid following instructions presented by unexpected browser pop-ups or fake bot verification pages. Organizations should deploy web filtering to block known malicious domains and IP addresses associated with ClickFix campaigns. Monitoring unusual outbound connections to untrusted IP addresses over non-standard ports is also recommended.

Response

If Macfinger ClickFix activity is detected, affected macOS hosts should be isolated immediately to stop further data exfiltration. Responders should perform a full forensic investigation to determine the extent of credential compromise. Potentially exposed credentials should be reset, and systems should be checked for persistence mechanisms such as unauthorized shell scripts or Mach-O binaries.

Simulation Execution

• Attack Narrative & Commands: An adversary uses a social engineering technique known as “ClickFix,” where a user is prompted to click a button (often a fake “fix” or “update”) that executes a malicious script. In this simulation, we mimic the final stage: the client-side browser/agent making a request to the Macfinger-controlled domain velvet-otter-glagceis.life to fetch a malicious .js file. This request is designed to match one of the three specific selection criteria in the detection logic.

• Regression Test Script:

  #!/bin/bash
  # Simulation script to trigger the Macfinger ClickFix detection rule
  
  echo "[*] Starting Macfinger ClickFix Simulation..."
  
  # Target 1: selection1 (site parameter)
  echo "[*] Simulating request to selection1..."
  curl -s -o /dev/null "http://velvet-otter-glagceis.life/t.js?site=test_payload"
  
  # Target 2: selection2 (specific hash file)
  echo "[*] Simulating request to selection2..."
  curl -s -o /dev/null "http://velvet-otter-glagceis.life/t.4b1009ff6c3f.js"
  
  # Target 3: selection3 (ext-b file)
  echo "[*] Simulating request to selection3..."
  curl -s -o /dev/null "http://velvet-otter-glagceis.life/ext-b.4f9db6afad06a.js"
  
  echo "[+] Simulation complete. Check SIEM for alerts."

• Cleanup Commands:

  # No local cleanup required as these are outbound network requests.
  # If local files were created, remove them:
  rm -f /tmp/macfinger_test_*