rescue-mac[.]com

Fake macOS help sites push Shamos infostealer via ClickFix technique Criminals are taking advantage of macOS users’ need to resolve technical issues to get them to infect their machines with the Shamos infostealer, Crowdstrike researchers have warned. To prevent macOS security features from blocking the installation, the malware peddlers are using the so-called ClickFix technique, which relies on users running malicious commands. The Shamos malware delivery campaign For the campaign, which unfolded between June and August 2025, the cyber crooks created fraudulent macOS help websites and made Google Search deliver ads pointing to them: Malicious ad pops up (Source: Crowdstrike) The fraudulent websites, parked on mac-safer[.]com and rescue-mac[.]com, provided instructions on how they can fix the problem they are having. Unfortunately, the instructions don’t solve the issue. Instead, they trigger the installation of Shamos – a variant of the Atomic macOS infostealer – when users copy, paste, and execute a specific one-line command in the Terminal app. The malicious instructions (Source: Crowdstrike) “The malicious installation command downloads Shamos Mach-O [file] into the /tmp/ directory, removes extended file attributes using xattr likely for bypassing Gatekeeper checks, assigns executable permissions via chmod, and then executes the stealer. Shamos executes anti-VM commands to verify that the Mach-O is not executing in a suspected sandbox environment,” Crowdstrike researchers explained. “The stealer then executes a variety of AppleScript commands for host reconnaissance and data collection tasks, including searching for known cryptocurrency-related wallet files and sensitive credential-based files on disk. Shamos attempts to exfiltrate collected sensitive files, including data from Keychain, AppleNotes, and browsers, using curl to transmit the data in a ZIP archive named out.zip.i2.” The malware also downloads a spoofed Ledger Live wallet application and a botnet module, and attempts for create/save a Plist file to assure its persistence. The researchers have also spotted an additional malvertising campaign for delivering Shamos, in which the criminals set up a GitHub repository ostensibly providing the popular iTerm2 terminal emulator for download. The instructions for installing the emulator included the same Shamos one-line installation command. Why cyber crooks love ClickFix “The one-line installation command enables eCrime actors to directly install the Mach-O executable onto the victim’s machine while bypassing Gatekeeper checks,” CrowdStrike researchers noted. ClickFix is a relatively new social engineering technique but, according to ESET, its use has skyrocketed in Q2 2025. Used by both cybercriminals and APT groups, its effectiveness (and subsequent popularity) is due to a combination of: Convincing error and fake CAPTCHA messages Simple instructions that are too technical for the average user to understand The trick reliably working on Windows, macOS and Linux users, and a multitude of campaigns targeting them via phishing emails, social media, ads mixed with search results, etc. “Microsoft Threat Intelligence has observed several threat actors selling the ClickFix builders (also called ‘Win + R’) on popular hacker forums since late 2024. Some of these actors are bundling ClickFix builders into their existing kits that already generate various files such as LNK, JavaScript, and SVG files,” Microsoft has shared last week. “The kits offer creation of landing pages with a variety of available lures including Cloudflare. They also offer construction of malicious commands that users will paste into the Windows Run dialog.” The effectiveness of the ClickFix tactic has also spurred security researcher mr.d0x to come up with FileFix, a similar technique that can be used to make users execute malicious commands by performing everyday Windows actions (e.g., using Windows File Explorer). And, according to Check Point researchers, it didn’t take long for threat actors to start experimenting with it. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

A new infostealer malware targeting Mac devices, called 'Shamos,' is targeting Mac devices in ClickFix attacks that impersonate troubleshooting guides and fixes. The new malware, which is a variant of the Atomic macOS Stealer (AMOS), was developed by the cybercriminal group "COOKIE SPIDER," and is used to steal data and credentials stored in web browsers, Keychain items, Apple Notes, and cryptocurrency wallets. CrowdStrike, which detected Shamos, reports that the malware has attempted infections against over three hundred environments worldwide that they monitor since June 2025. Promoted through ClickFix attacks Victims are lured via malvertising or fake GitHub repositories that utilize ClickFix attacks that prompt users into executing shell commands in the macOS Terminal. The threat actors prompt users to run these commands to install software or fix fake errors, but when executed, they actually download and execute the malware on the device. The ads or spoofed pages (mac-safer[.]com, rescue-mac[.]com) claim to provide help with macOS problems people are likely to search for, containing instructions directing them to copy and paste the command to fix the issue. Instead of fixing anything, the command decodes a Base64-encoded URL and fetches a malicious Bash script from a remote server. The script captures the user's password, downloads the Shamos mach-O executable, and prepares and executes the malware using 'xattr' (removes quarantine flag) and 'chmod' (makes binary executable) to bypass Gatekeeper. Shamos data theft Once executed on the device, Shamos executes anti-VM commands to verify it's not running on a sandbox, followed by AppleScript commands for host reconnaissance and data collection. Shamos searches for sensitive data on the device, including cryptocurrency wallet files, keychain data, Apple Notes data, and information stored on the victim's browser. After collecting everything, it packages them into an archive named 'out.zip' and transmits them to the attacker using curl. In the cases where the malware runs with sudo privileges, it also creates a Plist file (com.finder.helper.plist) and stores it in the user's LaunchDaemons directory, ensuring persistence via automatic execution on system startup. CrowdStrike also notes that Shamos can download additional payloads into the victim's home directory, and has observed cases where threat actors dropped a spoofed Ledger Live wallet app and a botnet module. MacOS users are advised never to execute commands on their system that they found online if they don't fully understand what they do. The same applies to GitHub repositories, as the platform is unfortunately a host to numerous malicious projects aimed at infecting unsuspecting users. When facing issues with macOS, it is better that you avoid sponsored search results and instead seek help in the Apple Community forums, which are moderated by Apple, or the system's built-in Help (Cmd + Space → "Help"). ClickFix attacks have become a widespread tactic in distributing malware, with threat actors using them in TikTok videos, disguising them as captchas, or as fixes for fake Google Meet errors. This tactic has proven to be so effective in deploying malware that it has been used in ransomware attacks and even by state-sponsored threat actors. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report