Clickfix Scam Targets macOS with AMOS Malware

Amber | Attack Report

Cybercriminals are running a slick new scam targeting macOS users by disguising malware as official downloads from brands like Spectrum and Homebrew. Through typo-squatted domains and deceptive “verification” prompts, victims are tricked into running a script that silently steals passwords and installs a new version of the Atomic macOS Stealer (AMOS). This multi-platform campaign is part of a growing trend in social engineering attacks, blending realistic web lures with malicious code tailored for each victim's device.

Reduce real exposure. Not just vulnerability volume.