Executive Summary
A new ClickFix-style attack campaign targeting macOS users has been identified, leveraging a fake Xcode installation site at `xcode-macos[.]com`. The attack bypasses traditional browser security by employing social engineering to convince victims to copy and paste a malicious command directly into their Terminal. This command initiates a multi-stage infection chain that leads to the execution of the Atomic macOS Stealer (AMOS).
The technical workflow involves an obfuscated shell script that uses AES decryption and gunzip decompression to execute a second-stage payload. The loader performs host discovery, sends execution telemetry, and clears macOS extended attributes to evade basic trust controls before launching the final AMOS binary.
This campaign is particularly effective against developers and technical staff who are accustomed to using Terminal commands for software installation. At the time of discovery, the lure infrastructure had zero detections on major reputation platforms, highlighting the urgency for behavioral-based web filtering and user awareness regarding untrusted command execution.