---
title: AMOS (Atomic macOS Stealer) malware deployed in latest ClickFix campaign targeting macOS users
url: https://www.broadcom.com/support/security-center/protection-bulletin/amos-atomic-macos-stealer-malware-deployed-in-latest-clickfix-campaign-targeting-macos-users
description: AMOS (Atomic macOS Stealer) malware deployed in latest ClickFix campaign targeting macOS users
---

# AMOS (Atomic macOS Stealer) malware deployed in latest ClickFix campaign targeting macOS users

June 24, 2026

A recent macOS ClickFix campaign utilizes fraudulent CAPTCHA prompts to distribute the Atomic macOS Stealer (AMOS) malware. As reported by researchers from Unit 42, this distribution technique deceives victims into pasting a malicious command directly into their system’s Terminal. When executed, the command spawns a stealthy Bash shell instance that retrieves a malicious disk image (DMG) from a remote server. Identified as the C++ "Odyssey" variant of AMOS, this sophisticated payload secures persistent access via LaunchAgents and trojanizes local cryptocurrency wallets like Ledger Live and Trezor. It systematically sweeps the compromised device for valuable data, harvesting keychain databases, Apple Notes, messaging histories, and various document formats. Furthermore, it scrapes logins, cookies, and autofill information from numerous Chromium- and Firefox-based browsers, including stored payment details and session data.

Symantec protects you from this threat, identified by the following:

**Carbon Black-based**

- Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.

**File-based**

- OSX.Trojan.Gen
- WS.Malware.1

**Web-based**

- Observed domains/IPs are covered under security categories in all WebPulse enabled products.