MacOS ClickFix AMOS Campaign

Since July 28, 2026 Ransom-ISAC tracked the ClickFix campaign that injects a t.js loader into compromised (mostly WordPress) sites to display a fake reCAPTCHA "Bot Protection" overlay which instructs macOS users to paste a Terminal command; that command fetches and runs a stager that deploys Atomic macOS Stealer (AMOS) to harvest browser credentials, Keychain items, and cryptocurrency wallets. Over seven weeks the tracker observed over 1,650 distinct infected websites, rapidly rotating C2 infrastructure (154 observed hostnames), payload hashes and network IOCs; the report provides regex and YARA detection patterns, host- and endpoint-level indicators, MITRE ATT&CK mapping, and remediation advice for site owners, hosts, and Mac users.