Back Malware-Traffic-Analysis

2026-09-29: Macfinger ClickFix activity

Malware-Traffic-Analysis • October 3, 2026

Share: View original

Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the " " page of this website.

I have not yet identified the macOS malware delivered by this campaign.

It doesn't appear to be AMOS Stealer or any of the other macOS malware families I've run across so far.

20.7 MB (20,660,190 bytes)

51.8 MB (51,821,688 bytes)

to return to the main page.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Ad Delivers AMOS Stealer via Claude Code Impersonation On October 2, 2026, a malicious advertisement impersonating Claude Code was identified as the delivery method for the Atomic macOS (AMOS) Stealer malware. The ad led users to a site that mimicked legitimate software installation but instead installed the AMOS Stealer, which is designed to harvest sensitive information from macOS systems. The malware was distributed through password-protected zip files, and users were prompted for permissions during installation. This incident highlights the ongoing threat of social engineering tactics in malware distribution. The scope of the impact is currently unclear, as the number of affected users has not been disclosed. The malware's detection and mitigation measures are still being assessed. No specific CVEs have been reported in relation to this incident. 2 sources 37

Extracted Entities

Malware (1)

Platforms (1)