ScanMalware.com
Known malicious kitcriticalstealer

Macfinger ClickFix (AMOS stealer) — injected loader on compromised websites

family: macfinger-clickfix-2026-09
Short link:scanmalware.com/h/194

Legitimate websites carrying an injected script that loads /t.js?site=<32 hex> from a rotating attacker domain, followed by a content-addressed loader (t.<hash>.js) and a fingerprinting stage (ext-b.<hash>.js). macOS visitors are shown a fake bot-protection page with ClickFix instructions to paste a Terminal command, which downloads a bash stager and an Atomic macOS Stealer (AMOS) variant. The attacker domain changes roughly daily, each on its own IP address, so this hunt follows the loader content and the public Emerging Threats signatures for the campaign rather than any single domain.

Anchors

YARA ruleClickFix_TDS_TJs_Site_Loader_Tag
SMQL queryrun
ids_signature:"AMOS ClickFix Campaign" OR js_sha256:4b1009ff6c3f89b4f4cb76714a9a5b7363eed633907342b101efbe99c3a14f95 OR js_sha256:4f9db6afd06aab4045d89a679191e154cc8cd283392d1f3bd16ac31347e1c3ac OR js_sha256:bce41e30b5e356f4a6e0d4ef8dec12a5f5ae941368d760696d31d17e0d33629b OR js_sha256:246e94baca7ed6d359017dca2e2355529aad83bca6453f5622e9b06825b86fd0

Provenance

Added: 2026-09-23 13:19
Matches pages whose traffic triggers the Emerging Threats "AMOS ClickFix Campaign" signatures, or that loaded one of the four known loader builds (t.4b1009ff6c3f.js, and ext-b.4f9db6afd06a.js / ext-b.bce41e30b5e3.js / ext-b.246e94baca7e.js). The fingerprinting stage is rebuilt every few days, so new ext-b builds will appear. The /t.js?site= value identifies the compromised website and stays the same when the attacker domain rotates. Some public lists label the attacker domains ClearFake; several compromised sites also carry a separate ClearFake injection, so a page can match both.
References:

Sightings (354)Atom feed

Showing the 200 most recently scanned.

HostScanScriptMatchScanned
nghkijtlwqog.id.wasmer.app8a61d468…—query2026-10-23 06:47
nghkijtlwqog.id.wasmer.app#html8a61d468…https://nghkijtlwqog.id.wasmer.app#htmlyara2026-10-23 06:47
nghkijtlwqog.id.wasmer.app8a61d468…https://nghkijtlwqog.id.wasmer.app/undefined?ts=1792738050yara2026-10-23 06:47
nghkijtlwqog.id.wasmer.app8a61d468…https://nghkijtlwqog.id.wasmer.app/yara2026-10-23 06:47
idealgestaoeseguranca.com.br1d04a10b…—query2026-10-20 16:33
idealgestaoeseguranca.com.br#html1d04a10b…https://idealgestaoeseguranca.com.br#htmlyara2026-10-20 16:33
idealgestaoeseguranca.com.br1d04a10b…https://idealgestaoeseguranca.com.br/yara2026-10-20 16:33
gasthof.punkthotel.deadeb92e6…—query2026-10-20 16:21
gasthof.punkthotel.de#htmladeb92e6…https://gasthof.punkthotel.de#htmlyara2026-10-20 16:21
gasthof.punkthotel.deadeb92e6…https://gasthof.punkthotel.de/wp-content/uploads/sites/2/2021/09/punkthotel-maechlerhof-kuehe-landschaft.jpgyara2026-10-20 16:21
gasthof.punkthotel.deadeb92e6…https://gasthof.punkthotel.de/yara2026-10-20 16:21
findmyperfecthome.co.uk#html81da899e…https://findmyperfecthome.co.uk#htmlyara2026-10-20 16:19
findmyperfecthome.co.uk81da899e…—query2026-10-20 16:19
www.findmyperfecthome.co.uk81da899e…https://www.findmyperfecthome.co.uk/wp-content/uploads/2021/03/logooo.pngyara2026-10-20 16:19
www.findmyperfecthome.co.uk81da899e…https://www.findmyperfecthome.co.uk/wp-content/uploads/2021/03/b-logo.pngyara2026-10-20 16:19
www.findmyperfecthome.co.uk81da899e…https://www.findmyperfecthome.co.uk/yara2026-10-20 16:19
morganaorvokki.com554461af…—query2026-10-20 16:07
morganaorvokki.com#html554461af…https://morganaorvokki.com#htmlyara2026-10-20 16:07
www.morganaorvokki.com554461af…https://www.morganaorvokki.com/yara2026-10-20 16:07
lambayecano.com735523bf…—query2026-10-20 15:54
lambayecano.com#html735523bf…https://lambayecano.com#htmlyara2026-10-20 15:54
www.lambayecano.com735523bf…https://www.lambayecano.com/wp-content/uploads/2022/09/Logo-Lambayecano-300x169.pngyara2026-10-20 15:54
www.lambayecano.com735523bf…https://www.lambayecano.com/yara2026-10-20 15:54
v2.bulwarrestauracja.pl21129d76…—query2026-10-20 13:41
v2.bulwarrestauracja.pl21129d76…https://v2.bulwarrestauracja.pl/#htmlyara2026-10-20 13:41
v2.bulwarrestauracja.pl21129d76…https://v2.bulwarrestauracja.pl/yara2026-10-20 13:41
digitalwithkaviya.wasmer.app1236cd1b…—query2026-10-18 17:47
digitalwithkaviya.wasmer.app#html1236cd1b…https://digitalwithkaviya.wasmer.app#htmlyara2026-10-18 17:47
digitalwithkaviya.wasmer.app1236cd1b…https://digitalwithkaviya.wasmer.app/yara2026-10-18 17:47
vially.consulting5855bbf5…—query2026-10-17 17:14
vially.consulting#html5855bbf5…https://vially.consulting#htmlyara2026-10-17 17:14
vially.consulting5855bbf5…https://vially.consulting/yara2026-10-17 17:14
ln24international.come85a05a2…—query2026-10-16 18:09
ln24international.come85a05a2…https://ln24international.com/tag/katie-zacharia/#htmlyara2026-10-16 18:09
ln24international.come85a05a2…https://ln24international.com/tag/katie-zacharia/yara2026-10-16 18:09
mogi.com.ng34529a2e…—query2026-10-16 12:38
mogi.com.ng34529a2e…https://mogi.com.ng/#htmlyara2026-10-16 12:38
mogi.com.ng34529a2e…https://mogi.com.ng/back.webpyara2026-10-16 12:38
mogi.com.ng34529a2e…https://mogi.com.ng/yara2026-10-16 12:38
mogi.com.ngafa579c8…—query2026-10-16 11:35
mogi.com.ngafa579c8…https://mogi.com.ng/#htmlyara2026-10-16 11:35
mogi.com.ngafa579c8…https://mogi.com.ng/back.webpyara2026-10-16 11:35
mogi.com.ngafa579c8…https://mogi.com.ng/yara2026-10-16 11:35
gautamize.com68a43ed6…—query2026-10-16 11:31
gautamize.com68a43ed6…https://gautamize.com/#htmlyara2026-10-16 11:31
gautamize.com68a43ed6…https://gautamize.com/yara2026-10-16 11:31
butlerskateland.com824ab4f7…—query2026-10-15 01:41
butlerskateland.com#html824ab4f7…https://butlerskateland.com#htmlyara2026-10-15 01:41
butlerskateland.com824ab4f7…https://butlerskateland.com/yara2026-10-15 01:41
brightbunnyservices.com#html491238ae…https://brightbunnyservices.com#htmlyara2026-10-15 01:40
brightbunnyservices.com491238ae…https://brightbunnyservices.com/yara2026-10-15 01:40
lp.imersaosevenx.com.br#htmlbe97f6f1…https://lp.imersaosevenx.com.br#htmlyara2026-10-15 01:30
lp.imersaosevenx.com.brbe97f6f1…https://lp.imersaosevenx.com.br/yara2026-10-15 01:30
ufabet168.wiki0bdd1a34…—query2026-10-15 01:02
ufabet168.wiki0bdd1a34…https://ufabet168.wiki/#htmlyara2026-10-15 01:02
ufabet168.wiki0bdd1a34…https://ufabet168.wiki/yara2026-10-15 01:02
seo.codesmithsystems.com4bbaab18…—query2026-10-15 00:50
seo.codesmithsystems.com#html4bbaab18…https://seo.codesmithsystems.com#htmlyara2026-10-15 00:50
seo.codesmithsystems.com4bbaab18…https://seo.codesmithsystems.com/yara2026-10-15 00:50
jollyparcheggio.itd58e4125…—query2026-10-15 00:26
www.jollyparcheggio.it#htmld58e4125…https://www.jollyparcheggio.it#htmlyara2026-10-15 00:26
www.jollyparcheggio.itd58e4125…https://www.jollyparcheggio.it/yara2026-10-15 00:26
explain-it-simple.net1ae0fb76…—query2026-10-14 21:10
explain-it-simple.net#html1ae0fb76…https://explain-it-simple.net#htmlyara2026-10-14 21:10
explain-it-simple.net1ae0fb76…https://explain-it-simple.net/yara2026-10-14 21:10
cinnalogy.com#htmlceb45588…https://cinnalogy.com#htmlyara2026-10-14 20:48
cinnalogy.comceb45588…https://cinnalogy.com/yara2026-10-14 20:48
ottawacapitalhomes.com1039adb4…—query2026-10-14 18:57
ottawacapitalhomes.com#html1039adb4…https://ottawacapitalhomes.com#htmlyara2026-10-14 18:57
ottawacapitalhomes.com1039adb4…https://ottawacapitalhomes.com/yara2026-10-14 18:57
sdermedique.com66a49b61…—query2026-10-14 18:27
sdermedique.com#html66a49b61…https://sdermedique.com#htmlyara2026-10-14 18:27
sdermedique.com66a49b61…https://sdermedique.com/yara2026-10-14 18:27
mandarinclassroom.hk6f54ac99…—query2026-10-14 14:37
www.mandarinclassroom.hk#html6f54ac99…https://www.mandarinclassroom.hk#htmlyara2026-10-14 14:37
www.mandarinclassroom.hk6f54ac99…https://www.mandarinclassroom.hk/en/yara2026-10-14 14:37
importdoortodoor.idc90bd0ee…—query2026-10-14 13:53
importdoortodoor.id#htmlc90bd0ee…https://importdoortodoor.id#htmlyara2026-10-14 13:53
importdoortodoor.idc90bd0ee…https://importdoortodoor.id/yara2026-10-14 13:53
marathonspiritueldefes.comc0467ac2…—query2026-10-13 13:12
authoritymarketingagent.com#html553f0616…https://authoritymarketingagent.com#htmlyara2026-10-11 23:35
authoritymarketingagent.com553f0616…—query2026-10-11 23:35
adamconsultings.com#html48de73bd…https://adamconsultings.com#htmlyara2026-10-11 22:52
blackiron.co.uk77676607…https://blackiron.co.uk/#htmlyara2026-10-11 14:05
blackiron.co.uk77676607…—query2026-10-11 14:05
lydigital.com.brc1efb491…https://lydigital.com.br/#htmlyara2026-10-11 11:49
lydigital.com.brc1efb491…—query2026-10-11 11:49
taazaproducts.comb4c83827…https://taazaproducts.com/#htmlyara2026-10-11 11:16
taazaproducts.comb4c83827…—query2026-10-11 11:16
trazoseguro.com49c51f5e…https://trazoseguro.com/#htmlyara2026-10-11 11:10
trazoseguro.com49c51f5e…—query2026-10-11 11:10
web.aloha-hk.com6b77b9b2…https://web.aloha-hk.com/#htmlyara2026-10-11 11:06
web.aloha-hk.com6b77b9b2…—query2026-10-11 11:06
samruby.vn#htmld37b380f…https://samruby.vn#htmlyara2026-10-09 14:12
samruby.vnd37b380f…—query2026-10-09 14:12
skincare.free.nf#html41f69859…https://skincare.free.nf#htmlyara2026-10-08 14:20
skincare.free.nf41f69859…—query2026-10-08 14:20
aacarrentals.comcf7d3ba5…https://aacarrentals.com/#htmlyara2026-10-08 12:30
aacarrentals.comcf7d3ba5…—query2026-10-08 12:30
born-to-bau.de#htmle20ca4fe…https://born-to-bau.de#htmlyara2026-10-08 12:29
born-to-bau.dee20ca4fe…—query2026-10-08 12:29
prediksihk.forum#html47d44301…https://prediksihk.forum#htmlyara2026-10-08 12:20
prediksihk.forum47d44301…—query2026-10-08 12:20
ukaramentalhealth.org#html47125f0f…https://ukaramentalhealth.org#htmlyara2026-10-08 12:19
ukaramentalhealth.org47125f0f…—query2026-10-08 12:19
tranquilacrestomahawk.com#htmlb0910aeb…https://tranquilacrestomahawk.com#htmlyara2026-10-08 12:19
www.jakob-webdesign.de3449b2b3…https://www.jakob-webdesign.de/#htmlyara2026-10-08 12:18
jakob-webdesign.de3449b2b3…—query2026-10-08 12:18
privatejetfuel.com#htmldc37ac5b…https://privatejetfuel.com#htmlyara2026-10-08 12:17
www.mrcistic.sk#htmlae8ad449…https://www.mrcistic.sk#htmlyara2026-10-08 12:13
mrcistic.skae8ad449…—query2026-10-08 12:13
findingzarephath.com#htmld724c1e4…https://findingzarephath.com#htmlyara2026-10-08 12:03
findingzarephath.comd724c1e4…—query2026-10-08 12:03
intelligenio.com#html21c16b54…https://intelligenio.com#htmlyara2026-10-08 12:02
intelligenio.com21c16b54…—query2026-10-08 12:02
dynamicxx.com#html9da668de…https://dynamicxx.com#htmlyara2026-10-08 12:01
dynamicxx.com9da668de…—query2026-10-08 12:01
emcagroup.co#htmldd377552…https://emcagroup.co#htmlyara2026-10-08 12:00
emcagroup.codd377552…—query2026-10-08 12:00
eadconsultltd.com#htmlb0e6cbf1…https://eadconsultltd.com#htmlyara2026-10-08 11:59
eadconsultltd.comb0e6cbf1…—query2026-10-08 11:59
dondaddy.com.au#htmla3ca44cb…https://dondaddy.com.au#htmlyara2026-10-08 11:58
dondaddy.com.aua3ca44cb…—query2026-10-08 11:58
clubfitnessgarrotxa.com#html5b0c67b7…https://clubfitnessgarrotxa.com#htmlyara2026-10-08 11:57
clubfitnessgarrotxa.com5b0c67b7…—query2026-10-08 11:57
bvraccounting.co.za#html6c5040cb…https://bvraccounting.co.za#htmlyara2026-10-08 11:56
bvraccounting.co.za6c5040cb…—query2026-10-08 11:56
alhilalnegombo.lk#html4a8e0dd7…https://alhilalnegombo.lk#htmlyara2026-10-08 11:55
alhilalnegombo.lk4a8e0dd7…—query2026-10-08 11:55
brasabeer.com#htmlef4925f7…https://brasabeer.com#htmlyara2026-10-08 11:53
brasabeer.comef4925f7…—query2026-10-08 11:53
baileycreative.london#htmlbe71e2a4…https://baileycreative.london#htmlyara2026-10-08 11:52
4seasonsnailsandspanampa.com#html3ffd3dd2…https://4seasonsnailsandspanampa.com#htmlyara2026-10-08 11:50
4seasonsnailsandspanampa.com3ffd3dd2…—query2026-10-08 11:50
titanuphose.com#htmle093581e…https://titanuphose.com#htmlyara2026-10-08 11:50
titanuphose.come093581e…—query2026-10-08 11:50
aiswebsite.wpenginepowered.com#html0ec0ccef…https://aiswebsite.wpenginepowered.com#htmlyara2026-10-08 11:48
aiswebsite.wpenginepowered.com0ec0ccef…—query2026-10-08 11:48
agspropertypoint.com#html0976078d…https://agspropertypoint.com#htmlyara2026-10-08 11:47
agspropertypoint.com0976078d…—query2026-10-08 11:47
storage-tech.quebec#htmlb17d803f…https://storage-tech.quebec#htmlyara2026-10-08 11:46
scarclinics.com#html293d54c4…https://scarclinics.com#htmlyara2026-10-08 11:45
scarclinics.com293d54c4…—query2026-10-08 11:45
stoneridgeorchard.us#html13d33af8…https://stoneridgeorchard.us#htmlyara2026-10-08 11:44
stoneridgeorchard.us13d33af8…—query2026-10-08 11:44
prominencevisaservices.com#html481f07a2…https://prominencevisaservices.com#htmlyara2026-10-08 11:41
prominencevisaservices.com481f07a2…—query2026-10-08 11:41
rspconferencehub.com#html0314b9d8…https://rspconferencehub.com#htmlyara2026-10-08 11:40
rspconferencehub.com0314b9d8…—query2026-10-08 11:40
randhawamotors.co#html87380694…https://randhawamotors.co#htmlyara2026-10-08 11:39
randhawamotors.co87380694…—query2026-10-08 11:39
peruinfinitetravel.com#html7c1a6a5c…https://peruinfinitetravel.com#htmlyara2026-10-08 11:38
peruinfinitetravel.com7c1a6a5c…—query2026-10-08 11:38
rabbihorowitz.com#htmlfd768f01…https://rabbihorowitz.com#htmlyara2026-10-08 11:37
rabbihorowitz.comfd768f01…—query2026-10-08 11:37
postaconsultora.com#html95459409…https://postaconsultora.com#htmlyara2026-10-08 11:35
postaconsultora.com95459409…—query2026-10-08 11:35
nostc.in#html59073e0d…https://nostc.in#htmlyara2026-10-08 11:34
nostc.in59073e0d…—query2026-10-08 11:34
moitruongdothi.com.vn#html41fde6d1…https://moitruongdothi.com.vn#htmlyara2026-10-08 11:34
moitruongdothi.com.vn41fde6d1…—query2026-10-08 11:34
liyamotosiklet.com#html6927894f…https://liyamotosiklet.com#htmlyara2026-10-08 11:32
liyamotosiklet.com6927894f…—query2026-10-08 11:32
magoproject.com#html79540ee3…https://magoproject.com#htmlyara2026-10-08 11:32
magoproject.com79540ee3…—query2026-10-08 11:32
macoavell.in#htmlccf3f4cf…https://macoavell.in#htmlyara2026-10-08 11:31
macoavell.inccf3f4cf…—query2026-10-08 11:31
letsstyle.in#htmlc8b8b1f5…https://letsstyle.in#htmlyara2026-10-08 11:29
letsstyle.inc8b8b1f5…—query2026-10-08 11:29
lamalimo.com#htmlf970dee8…https://lamalimo.com#htmlyara2026-10-08 11:27
lamalimo.comf970dee8…—query2026-10-08 11:27
kokoindonesia.com#html699d473b…https://kokoindonesia.com#htmlyara2026-10-08 11:26
kokoindonesia.com699d473b…—query2026-10-08 11:26
kidzwonderlandllc.com#htmle75a5dcb…https://kidzwonderlandllc.com#htmlyara2026-10-08 11:24
kidzwonderlandllc.come75a5dcb…—query2026-10-08 11:24
jahazigraphics.co.ke#html97353e1d…https://jahazigraphics.co.ke#htmlyara2026-10-08 11:22
jahazigraphics.co.ke97353e1d…—query2026-10-08 11:22
xtremeroofingpros.com#html7cb03d84…https://xtremeroofingpros.com#htmlyara2026-10-08 11:21
xtremeroofingpros.com7cb03d84…—query2026-10-08 11:21
www.cb-system.net#htmlce770094…https://www.cb-system.net#htmlyara2026-10-08 11:19
cb-system.netce770094…—query2026-10-08 11:19
www.lacasadimiryam.it#html881786b9…https://www.lacasadimiryam.it#htmlyara2026-10-08 11:18
lacasadimiryam.it881786b9…—query2026-10-08 11:18
www.jakob-webdesign.de#html56bfdf55…https://www.jakob-webdesign.de#htmlyara2026-10-08 11:18
jakob-webdesign.de56bfdf55…—query2026-10-08 11:18
www.dekor.ba#html99c029c9…https://www.dekor.ba#htmlyara2026-10-08 11:16
dekor.ba99c029c9…—query2026-10-08 11:16
villasml.com#htmlc7907d7d…https://villasml.com#htmlyara2026-10-08 11:15
villasml.comc7907d7d…—query2026-10-08 11:15
instalasijaringanbekasi.com898b0041…https://instalasijaringanbekasi.com/#htmlyara2026-10-08 10:46
rramadasmakeovers.com54ea9654…https://rramadasmakeovers.com/#htmlyara2026-10-08 10:43
rramadasmakeovers.com54ea9654…—query2026-10-08 10:43
jakob-webdesign.de#html9ab7d2bf…https://jakob-webdesign.de#htmlyara2026-10-08 10:41
jakob-webdesign.de9ab7d2bf…—query2026-10-08 10:41
dixutana.se#html41088b43…https://dixutana.se#htmlyara2026-10-08 07:25
dixutana.se41088b43…—query2026-10-08 07:25
www.expeditrans.org13acd1c9…https://www.expeditrans.org/#htmlyara2026-10-04 04:25
expeditrans.org13acd1c9…—query2026-10-04 04:25
www.pmetal.cl#htmle81095b7…https://www.pmetal.cl#htmlyara2026-10-04 04:14
pmetal.cle81095b7…—query2026-10-04 04:14