ScanMalware.com
Known malicious kitcriticalstealer

Macfinger ClickFix (AMOS stealer) — injected loader on compromised websites

family: macfinger-clickfix-2026-09
Short link:scanmalware.com/h/194

Legitimate websites carrying an injected script that loads /t.js?site=<32 hex> from a rotating attacker domain, followed by a content-addressed loader (t.<hash>.js) and a fingerprinting stage (ext-b.<hash>.js). macOS visitors are shown a fake bot-protection page with ClickFix instructions to paste a Terminal command, which downloads a bash stager and an Atomic macOS Stealer (AMOS) variant. The attacker domain changes roughly daily, each on its own IP address, so this hunt follows the loader content and the public Emerging Threats signatures for the campaign rather than any single domain.

Anchors

Hunting ruleClickFix_TDS_TJs_Site_Loader_Tag
SMQL queryrun
ids_signature:"AMOS ClickFix Campaign" OR js_sha256:4b1009ff6c3f89b4f4cb76714a9a5b7363eed633907342b101efbe99c3a14f95 OR js_sha256:4f9db6afd06aab4045d89a679191e154cc8cd283392d1f3bd16ac31347e1c3ac OR js_sha256:bce41e30b5e356f4a6e0d4ef8dec12a5f5ae941368d760696d31d17e0d33629b OR js_sha256:246e94baca7ed6d359017dca2e2355529aad83bca6453f5622e9b06825b86fd0

Provenance

Added: 2026-09-23 13:19
Matches pages whose traffic triggers the Emerging Threats "AMOS ClickFix Campaign" signatures, or that loaded one of the four known loader builds (t.4b1009ff6c3f.js, and ext-b.4f9db6afd06a.js / ext-b.bce41e30b5e3.js / ext-b.246e94baca7e.js). The fingerprinting stage is rebuilt every few days, so new ext-b builds will appear. The /t.js?site= value identifies the compromised website and stays the same when the attacker domain rotates. Some public lists label the attacker domains ClearFake; several compromised sites also carry a separate ClearFake injection, so a page can match both.
References:

Sightings (481)Atom feed

Showing the 200 most recently scanned.

HostScanScriptMatchScanned
teczkibezkwasowe.com4bfc3edf…—query2026-11-13 21:47
www.teczkibezkwasowe.com#html4bfc3edf…https://www.teczkibezkwasowe.com#htmlrule2026-11-13 21:47
www.teczkibezkwasowe.com4bfc3edf…https://www.teczkibezkwasowe.com/rule2026-11-13 21:47
mgenergia.com.br8226e2cb…—query2026-11-13 20:47
mgenergia.com.br#html8226e2cb…https://mgenergia.com.br#htmlrule2026-11-13 20:47
mgenergia.com.br8226e2cb…https://mgenergia.com.br/wp-content/uploads/2025/11/23DESCONTO-296x300.pngrule2026-11-13 20:47
mgenergia.com.br8226e2cb…https://mgenergia.com.br/rule2026-11-13 20:47
freshstartwithnewbeginnings.com864ece3a…—query2026-11-11 07:47
freshstartwithnewbeginnings.com#html864ece3a…https://freshstartwithnewbeginnings.com#htmlrule2026-11-11 07:47
freshstartwithnewbeginnings.com864ece3a…https://freshstartwithnewbeginnings.com/rule2026-11-11 07:47
bakermediaco.com#html776ff676…https://bakermediaco.com#htmlrule2026-11-10 22:47
bakermediaco.com776ff676…https://bakermediaco.com/rule2026-11-10 22:47
kfouriadvogados.adv.brdaed7252…https://kfouriadvogados.adv.br/rule2026-11-10 21:47
atteelektronik.com.tr1c56a231…—query2026-11-10 03:47
atteelektronik.com.tr#html1c56a231…https://atteelektronik.com.tr#htmlrule2026-11-10 03:47
atteelektronik.com.tr1c56a231…https://atteelektronik.com.tr/img/favicon.icorule2026-11-10 03:47
atteelektronik.com.tr1c56a231…https://atteelektronik.com.tr/wp-content/themes/lgservismain.jsrule2026-11-10 03:47
atteelektronik.com.tr1c56a231…https://atteelektronik.com.tr/rule2026-11-10 03:47
promopixelstudio.com6c61e0c3…—query2026-11-08 18:47
promopixelstudio.com#html6c61e0c3…https://promopixelstudio.com#htmlrule2026-11-08 18:47
promopixelstudio.com6c61e0c3…https://promopixelstudio.com/rule2026-11-08 18:47
serenespheresph.com#html36af90d7…https://serenespheresph.com#htmlrule2026-11-08 16:47
serenespheresph.com36af90d7…https://serenespheresph.com/rule2026-11-08 16:47
sfwaretech.com#htmlb7af3a90…https://sfwaretech.com#htmlrule2026-11-08 13:47
sfwaretech.comb7af3a90…—query2026-11-08 13:47
sfwaretech.comb7af3a90…https://sfwaretech.com/verify/rule2026-11-08 13:47
sfwaretech.comb7af3a90…https://sfwaretech.com/wp-content/plugins/elementor/assets/css/widget-icon-list.min.cssrule2026-11-08 13:47
sfwaretech.comb7af3a90…https://sfwaretech.com/rule2026-11-08 13:47
pascualini.com.ar1e468261…—query2026-11-08 11:47
pascualini.com.ar#html1e468261…https://pascualini.com.ar#htmlrule2026-11-08 11:47
pascualini.com.ar1e468261…https://pascualini.com.ar/rule2026-11-08 11:47
greenpaintingco.comff9f43b6…—query2026-11-08 05:47
greenpaintingco.com#htmlff9f43b6…https://greenpaintingco.com#htmlrule2026-11-08 05:47
greenpaintingco.comff9f43b6…https://greenpaintingco.com/rule2026-11-08 05:47
karyangroups.com47ff213d…—query2026-11-06 13:47
karyangroups.com#html47ff213d…https://karyangroups.com#htmlrule2026-11-06 13:47
karyangroups.com47ff213d…https://karyangroups.com/rule2026-11-06 13:47
poliklinikazzaara.com.my96766c85…—query2026-11-06 02:47
poliklinikazzaara.com.my#html96766c85…https://poliklinikazzaara.com.my#htmlrule2026-11-06 02:47
poliklinikazzaara.com.my96766c85…https://poliklinikazzaara.com.my/wp-content/uploads/wprevslider/avatars/1655440346_5494391970573103.jpgrule2026-11-06 02:47
poliklinikazzaara.com.my96766c85…https://poliklinikazzaara.com.my/wp-content/uploads/wprevslider/avatars/1653824597_5584721638233656.jpgrule2026-11-06 02:47
poliklinikazzaara.com.my96766c85…https://poliklinikazzaara.com.my/wp-content/uploads/wprevslider/avatars/1656315020_7512521202153532.jpgrule2026-11-06 02:47
poliklinikazzaara.com.my96766c85…https://poliklinikazzaara.com.my/wp-content/uploads/wprevslider/avatars/1655905274_5361891277207303.jpgrule2026-11-06 02:47
poliklinikazzaara.com.my96766c85…https://poliklinikazzaara.com.my/wp-content/uploads/wprevslider/avatars/1654933673_5672154959486022.jpgrule2026-11-06 02:47
poliklinikazzaara.com.my96766c85…https://poliklinikazzaara.com.my/wp-content/uploads/wprevslider/avatars/1656355578_5002745573178326.jpgrule2026-11-06 02:47
poliklinikazzaara.com.my96766c85…https://poliklinikazzaara.com.my/rule2026-11-06 02:47
edmillo.arta67722a7…—query2026-11-05 17:47
edmillo.art#htmla67722a7…https://edmillo.art#htmlrule2026-11-05 17:47
edmillo.arta67722a7…https://edmillo.art/rule2026-11-05 17:47
brand-accord.come0b19c1a…—query2026-11-04 14:47
brand-accord.com#htmle0b19c1a…https://brand-accord.com#htmlrule2026-11-04 14:47
brand-accord.come0b19c1a…https://brand-accord.com/rule2026-11-04 14:47
randmteam.comf595011b…—query2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/#htmlrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2019/04/cta-icon.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon_flooring.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon_carpentry.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon_handyman_services.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon_windows.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon_remodeling.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon_property_management_solutions.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon_interior_demolition.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon_decks.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon_drywall.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon_design_build.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon-home-additions.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon-mitigation-restoration.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon-basement-finishing.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon-kitchen-bath-remodels.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2019/04/3d.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon-decks-porches.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/icon_painting.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/IMG-20240627-WA0009.jpgrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/IMG-20240627-WA0012.jpgrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/IMG-20240627-WA0016.jpgrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2019/04/house.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2019/04/helmet.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2019/04/blueprint.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/Estado_de_los_Estados_Unidos.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2024/07/rmteam-logo.pngrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/wp-content/uploads/2019/04/about-us.jpgrule2026-11-04 11:52
randmteam.comf595011b…https://randmteam.com/rule2026-11-04 11:52
criptotario.comd0abcfea…—query2026-11-03 12:47
criptotario.com#htmld0abcfea…https://criptotario.com#htmlrule2026-11-03 12:47
criptotario.comd0abcfea…https://criptotario.com/rule2026-11-03 12:47
bicda.com.bdfcf4fc3d…—query2026-11-02 23:47
bicda.com.bd#htmlfcf4fc3d…https://bicda.com.bd#htmlrule2026-11-02 23:47
bicda.com.bdfcf4fc3d…https://bicda.com.bd/rule2026-11-02 23:47
ipivot.it6b3c63a0…—query2026-10-31 20:47
www.ipivot.it#html6b3c63a0…https://www.ipivot.it#htmlrule2026-10-31 20:47
www.ipivot.it6b3c63a0…https://www.ipivot.it/rule2026-10-31 20:47
pureshehad.com#html55e26dce…https://pureshehad.com#htmlrule2026-10-31 19:47
pureshehad.com55e26dce…—query2026-10-31 19:47
pureshehad.com55e26dce…https://pureshehad.com/product/pure-shehad-500gm/rule2026-10-31 19:47
pureshehad.com55e26dce…https://pureshehad.com/rule2026-10-31 19:47
visiterlarca.com034e054a…—query2026-10-31 15:03
visiterlarca.com034e054a…https://visiterlarca.com/#htmlrule2026-10-31 15:03
visiterlarca.com034e054a…https://visiterlarca.com/rule2026-10-31 15:03
upla.es247d60d5…—query2026-10-30 22:47
upla.es#html247d60d5…https://upla.es#htmlrule2026-10-30 22:47
upla.es247d60d5…https://upla.es/rule2026-10-30 22:47
kazmitailorsandclothdraper.com9ffd98d3…—query2026-10-30 14:47
kazmitailorsandclothdraper.com#html9ffd98d3…https://kazmitailorsandclothdraper.com#htmlrule2026-10-30 14:47
kazmitailorsandclothdraper.com9ffd98d3…https://kazmitailorsandclothdraper.com/rule2026-10-30 14:47
autosolutionsconnect.com6dc2516f…—query2026-10-30 00:47
autosolutionsconnect.com#html6dc2516f…https://autosolutionsconnect.com#htmlrule2026-10-30 00:47
autosolutionsconnect.com6dc2516f…https://autosolutionsconnect.com/rule2026-10-30 00:47
visiterlarca.comf8b80803…—query2026-10-29 16:48
visiterlarca.comf8b80803…https://visiterlarca.com/#htmlrule2026-10-29 16:48
visiterlarca.comf8b80803…https://visiterlarca.com/rule2026-10-29 16:48
implantecenter.com.br31378597…—query2026-10-28 09:47
implantecenter.com.br#html31378597…https://implantecenter.com.br#htmlrule2026-10-28 09:47
implantecenter.com.br31378597…https://implantecenter.com.br/rule2026-10-28 09:47
gpmobile.com8564a7aa…—query2026-10-28 05:47
gpmobile.com#html8564a7aa…https://gpmobile.com#htmlrule2026-10-28 05:47
gpmobile.com8564a7aa…https://gpmobile.com/rule2026-10-28 05:47
702490.us28.myftpupload.com5fc9e2ef…—query2026-10-27 02:47
702490.us28.myftpupload.com#html5fc9e2ef…https://702490.us28.myftpupload.com#htmlrule2026-10-27 02:47
702490.us28.myftpupload.com5fc9e2ef…https://702490.us28.myftpupload.com/rule2026-10-27 02:47
fondazioneoav.it0ca86489…—query2026-10-27 00:47
fondazioneoav.it#html0ca86489…https://fondazioneoav.it#htmlrule2026-10-27 00:47
fombord.comce108b63…—query2026-10-25 22:47
fombord.com#htmlce108b63…https://fombord.com#htmlrule2026-10-25 22:47
fombord.comce108b63…https://fombord.com/rule2026-10-25 22:47
cleo-wasmer-app-deployments.wasmer.app63f41c1e…—query2026-10-24 14:47
cleo-wasmer-app-deployments.wasmer.app#html63f41c1e…https://cleo-wasmer-app-deployments.wasmer.app#htmlrule2026-10-24 14:47
cleo-wasmer-app-deployments.wasmer.app63f41c1e…https://cleo-wasmer-app-deployments.wasmer.app/rule2026-10-24 14:47
nghkijtlwqog.id.wasmer.app8a61d468…—query2026-10-23 06:47
nghkijtlwqog.id.wasmer.app#html8a61d468…https://nghkijtlwqog.id.wasmer.app#htmlrule2026-10-23 06:47
nghkijtlwqog.id.wasmer.app8a61d468…https://nghkijtlwqog.id.wasmer.app/undefined?ts=1792738050rule2026-10-23 06:47
nghkijtlwqog.id.wasmer.app8a61d468…https://nghkijtlwqog.id.wasmer.app/rule2026-10-23 06:47
idealgestaoeseguranca.com.br1d04a10b…—query2026-10-20 16:33
idealgestaoeseguranca.com.br#html1d04a10b…https://idealgestaoeseguranca.com.br#htmlrule2026-10-20 16:33
idealgestaoeseguranca.com.br1d04a10b…https://idealgestaoeseguranca.com.br/rule2026-10-20 16:33
gasthof.punkthotel.deadeb92e6…—query2026-10-20 16:21
gasthof.punkthotel.de#htmladeb92e6…https://gasthof.punkthotel.de#htmlrule2026-10-20 16:21
gasthof.punkthotel.deadeb92e6…https://gasthof.punkthotel.de/wp-content/uploads/sites/2/2021/09/punkthotel-maechlerhof-kuehe-landschaft.jpgrule2026-10-20 16:21
gasthof.punkthotel.deadeb92e6…https://gasthof.punkthotel.de/rule2026-10-20 16:21
findmyperfecthome.co.uk#html81da899e…https://findmyperfecthome.co.uk#htmlrule2026-10-20 16:19
findmyperfecthome.co.uk81da899e…—query2026-10-20 16:19
www.findmyperfecthome.co.uk81da899e…https://www.findmyperfecthome.co.uk/wp-content/uploads/2021/03/logooo.pngrule2026-10-20 16:19
www.findmyperfecthome.co.uk81da899e…https://www.findmyperfecthome.co.uk/wp-content/uploads/2021/03/b-logo.pngrule2026-10-20 16:19
www.findmyperfecthome.co.uk81da899e…https://www.findmyperfecthome.co.uk/rule2026-10-20 16:19
morganaorvokki.com554461af…—query2026-10-20 16:07
morganaorvokki.com#html554461af…https://morganaorvokki.com#htmlrule2026-10-20 16:07
www.morganaorvokki.com554461af…https://www.morganaorvokki.com/rule2026-10-20 16:07
lambayecano.com735523bf…—query2026-10-20 15:54
lambayecano.com#html735523bf…https://lambayecano.com#htmlrule2026-10-20 15:54
www.lambayecano.com735523bf…https://www.lambayecano.com/wp-content/uploads/2022/09/Logo-Lambayecano-300x169.pngrule2026-10-20 15:54
www.lambayecano.com735523bf…https://www.lambayecano.com/rule2026-10-20 15:54
v2.bulwarrestauracja.pl21129d76…—query2026-10-20 13:41
v2.bulwarrestauracja.pl21129d76…https://v2.bulwarrestauracja.pl/#htmlrule2026-10-20 13:41
v2.bulwarrestauracja.pl21129d76…https://v2.bulwarrestauracja.pl/rule2026-10-20 13:41
digitalwithkaviya.wasmer.app1236cd1b…—query2026-10-18 17:47
digitalwithkaviya.wasmer.app#html1236cd1b…https://digitalwithkaviya.wasmer.app#htmlrule2026-10-18 17:47
digitalwithkaviya.wasmer.app1236cd1b…https://digitalwithkaviya.wasmer.app/rule2026-10-18 17:47
vially.consulting5855bbf5…—query2026-10-17 17:14
vially.consulting#html5855bbf5…https://vially.consulting#htmlrule2026-10-17 17:14
vially.consulting5855bbf5…https://vially.consulting/rule2026-10-17 17:14
ln24international.come85a05a2…—query2026-10-16 18:09
ln24international.come85a05a2…https://ln24international.com/tag/katie-zacharia/#htmlrule2026-10-16 18:09
ln24international.come85a05a2…https://ln24international.com/tag/katie-zacharia/rule2026-10-16 18:09
mogi.com.ng34529a2e…—query2026-10-16 12:38
mogi.com.ng34529a2e…https://mogi.com.ng/#htmlrule2026-10-16 12:38
mogi.com.ng34529a2e…https://mogi.com.ng/back.webprule2026-10-16 12:38
mogi.com.ng34529a2e…https://mogi.com.ng/rule2026-10-16 12:38
mogi.com.ngafa579c8…—query2026-10-16 11:35
mogi.com.ngafa579c8…https://mogi.com.ng/#htmlrule2026-10-16 11:35
mogi.com.ngafa579c8…https://mogi.com.ng/back.webprule2026-10-16 11:35
mogi.com.ngafa579c8…https://mogi.com.ng/rule2026-10-16 11:35
gautamize.com68a43ed6…—query2026-10-16 11:31
gautamize.com68a43ed6…https://gautamize.com/#htmlrule2026-10-16 11:31
gautamize.com68a43ed6…https://gautamize.com/rule2026-10-16 11:31
butlerskateland.com824ab4f7…—query2026-10-15 01:41
butlerskateland.com#html824ab4f7…https://butlerskateland.com#htmlrule2026-10-15 01:41
butlerskateland.com824ab4f7…https://butlerskateland.com/rule2026-10-15 01:41
brightbunnyservices.com#html491238ae…https://brightbunnyservices.com#htmlrule2026-10-15 01:40
brightbunnyservices.com491238ae…https://brightbunnyservices.com/rule2026-10-15 01:40
lp.imersaosevenx.com.br#htmlbe97f6f1…https://lp.imersaosevenx.com.br#htmlrule2026-10-15 01:30
lp.imersaosevenx.com.brbe97f6f1…https://lp.imersaosevenx.com.br/rule2026-10-15 01:30
ufabet168.wiki0bdd1a34…—query2026-10-15 01:02
ufabet168.wiki0bdd1a34…https://ufabet168.wiki/#htmlrule2026-10-15 01:02
ufabet168.wiki0bdd1a34…https://ufabet168.wiki/rule2026-10-15 01:02
seo.codesmithsystems.com4bbaab18…—query2026-10-15 00:50
seo.codesmithsystems.com#html4bbaab18…https://seo.codesmithsystems.com#htmlrule2026-10-15 00:50
seo.codesmithsystems.com4bbaab18…https://seo.codesmithsystems.com/rule2026-10-15 00:50
jollyparcheggio.itd58e4125…—query2026-10-15 00:26
www.jollyparcheggio.it#htmld58e4125…https://www.jollyparcheggio.it#htmlrule2026-10-15 00:26
www.jollyparcheggio.itd58e4125…https://www.jollyparcheggio.it/rule2026-10-15 00:26
explain-it-simple.net1ae0fb76…—query2026-10-14 21:10
explain-it-simple.net#html1ae0fb76…https://explain-it-simple.net#htmlrule2026-10-14 21:10
explain-it-simple.net1ae0fb76…https://explain-it-simple.net/rule2026-10-14 21:10
cinnalogy.com#htmlceb45588…https://cinnalogy.com#htmlrule2026-10-14 20:48
cinnalogy.comceb45588…https://cinnalogy.com/rule2026-10-14 20:48
ottawacapitalhomes.com1039adb4…—query2026-10-14 18:57
ottawacapitalhomes.com#html1039adb4…https://ottawacapitalhomes.com#htmlrule2026-10-14 18:57
ottawacapitalhomes.com1039adb4…https://ottawacapitalhomes.com/rule2026-10-14 18:57
sdermedique.com66a49b61…—query2026-10-14 18:27
sdermedique.com#html66a49b61…https://sdermedique.com#htmlrule2026-10-14 18:27
sdermedique.com66a49b61…https://sdermedique.com/rule2026-10-14 18:27