🚨 macOS-Specific ClickFix Campaign Targeting Claude Code Users: Detect It Early
We identified a campaign targeting users of Claude Code, Grok, n8n, NotebookLM, Gemini CLI, OpenClaw, and Cursor with AMOS Stealer ⚠️
As macOS adoption grows in enterprise environments, these attacks exploit gaps in visibility and make early-stage detection harder.
🎯 In this case, attackers use a redirect from Google ads to a fake Claude Code documentation page and a ClickFix flow to deliver a payload. A terminal command downloads an encoded script, which installs AMOS Stealer, collects browser data, credentials, Keychain contents, and sensitive files, then deploys a backdoor.
The backdoor module (~/.mainhelper) was first described by Moonlock Lab in July 2025. Our analysis shows that it has since evolved. While the original version supported only a limited set of commands via periodic HTTP polling, the updated variant significantly expands functionality and introduces a fully interactive reverse shell over WebSocket with PTY support.
❗️ This turns the infection from data theft into persistent, hands-on access to the infected Mac, giving the attacker real-time control over the system.
Multi-stage delivery, obfuscated scripts, and abuse of legitimate macOS components break visibility into fragmented signals. Triage slows down, and escalation decisions take longer, leading to credential theft and data exfiltration.
⚡️ #ANYRUN Sandbox lets security teams analyze macOS, Windows, Linux, and Android threats with full visibility into execution, attacker behavior, and artifacts, helping detect threats early and build stronger detection logic, while reducing MTTD & MTTR.
👉 https://app.any.run/tasks/74f5000d-aa91-4745-9fc7-fdd95549874b/?utm_source=telegram&utm_medium=post&utm_campaign=macOS_clickfix&utm_term=250326&utm_content=linktoservice
💬
https://x.com/anyrun_app/status/2036799880392265928?s=20
👨💻️ Expand your SOC’s cross-platform threat visibility. https://any.run/cybersecurity-blog/anyrun-macos-sandbox/?utm_source=telegram&utm_medium=post&utm_campaign=macOS_clickfix&utm_term=250326&utm_content=linktoblog
#ExploreWithANYRUN
![[🛡] MTProxyBoy Profile](/_next/image?url=https%3A%2F%2Fcdn.tgdio.com%2Fchannels%2F2025%2F10%2Fmtproxyboy.webp&w=256&q=75)
