Mac Users Targeted in ClickFix Campaign Delivering Atomic Stealer Malware A new ClickFix social engineering campaign is targeting macOS users, tricking victims into manually installing Atomic macOS Stealer (AMOS) malware by disguising malicious commands as routine verification steps. The attack begins when users encounter a fake CAPTCHA or error prompt on a compromised or fraudulent website, instructing them to copy a command, open Terminal, and execute it ostensibly to complete a security check. Unlike traditional exploits, this method relies on deception rather than software vulnerabilities, leveraging trust in familiar security prompts to coerce victims into executing the infection themselves. Once the command runs, it downloads a hidden disk image (DMG) containing Atomic Stealer, which operates stealthily mounting without visible indicators in Finder or on the desktop. The malware may then display a counterfeit macOS authentication dialog, tricking users into entering their password to grant elevated privileges. Atomic Stealer’s capabilities are extensive, targeting: - Browser data: Saved credentials, cookies, autofill details, and payment information from Chromium-based browsers (Chrome, Edge, Brave, Opera, etc.) and Firefox. - System credentials: Apple Keychain passwords, Safari cookies, and Apple Notes. - Messaging apps: Telegram and Discord desktop data, enabling attackers to impersonate victims or access sensitive communications. - Cryptocurrency assets: Desktop wallets (Exodus, Electrum, Atomic Wallet, Ledger, Trezor, etc.) and 200+ crypto-related browser extensions, with the ability to replace legitimate wallet apps with malicious versions. - Files: PDFs, TXT, and RTF documents. Stolen data is compressed into a ZIP archive and exfiltrated to an attacker-controlled server, where it can be used for account takeovers, financial theft, or follow-on scams. Kaspersky’s report highlights that ClickFix lures, previously focused on Windows users, are now expanding to macOS, employing tactics similar to a recent Script Editor campaign that also relied on social engineering. The attack’s effectiveness stems from bypassing technical defenses by exploiting user trust victims unknowingly authorize the malware’s installation and grant administrative access. Legitimate websites never require Terminal commands for verification, and macOS users are advised to treat unexpected password prompts with skepticism. The campaign underscores the growing threat of malware-as-a-service (MaaS) tools like Atomic Stealer, which lower the barrier for cybercriminals targeting Apple’s ecosystem.

SilabRAT: A Stealthy Crypto-Draining Malware Emerges as MaaS A new remote access trojan (RAT), SilabRAT, has surfaced on dark web forums, designed to bypass passwords and multi-factor authentication (MFA) by hijacking active user sessions to drain cryptocurrency. First advertised in late 2025 by a Russian-speaking threat actor known as o1oo1, the malware is offered as a malware-as-a-service (MaaS) for $5,000 per month. Buyers who often distribute it via email spam and ClickFix lures have reported success rates, with over 90% of infected machines remaining online during month-long campaigns. SilabRAT evades detection by disguising itself as HijackLoader, a known packer, rather than its true payload. Its standout features include: - Hidden Virtual Network Computing (HVNC): Operators control infected machines without visible windows or cursor movement, making activity appear as legitimate user sessions. - Browser-Profile Cloning: The malware copies entire browser profiles including extensions, storage, and device fingerprints to an attacker’s system, allowing stolen sessions to persist even after logouts. A Target.dll module ensures the cloned profile loads seamlessly on the victim’s device. The malware’s primary goal is cryptocurrency theft. A background module scans for wallets upon infection, attempting to crack passwords using credentials harvested from the victim’s browser. It bypasses Chrome’s App-Bound Encryption via a COM-elevation technique and includes a clipboard clipper to swap wallet addresses mid-transaction. Additional capabilities include: - Keystroke logging and clipboard monitoring - Remote desktop access via TightVNC - A UAC bypass previously used by LockBit and BlackMatter - Persistence through registry keys or scheduled tasks Group-IB, which analyzed the threat, warns that SilabRAT’s developer plans to expand its reach by injecting code into Electron-based wallet apps, such as Ledger Live and Trezor Suite. While traditional defenses like MFA and patching can help, the malware’s session-hijacking tactics allow it to bypass even secured logins.