ScanMalware.com
Known malicious kitcriticalstealer

Macfinger ClickFix (AMOS stealer) — injected loader on compromised websites

family: macfinger-clickfix-2026-09

Legitimate websites carrying an injected script that loads /t.js?site=<32 hex> from a rotating attacker domain, followed by a content-addressed loader (t.<hash>.js) and a fingerprinting stage (ext-b.<hash>.js). macOS visitors are shown a fake bot-protection page with ClickFix instructions to paste a Terminal command, which downloads a bash stager and an Atomic macOS Stealer (AMOS) variant. The attacker domain changes roughly daily, each on its own IP address, so this hunt follows the loader content and the public Emerging Threats signatures for the campaign rather than any single domain.

Anchors

SMQL queryrun
ids_signature:"AMOS ClickFix Campaign" OR js_sha256:4b1009ff6c3f89b4f4cb76714a9a5b7363eed633907342b101efbe99c3a14f95 OR js_sha256:4f9db6afd06aab4045d89a679191e154cc8cd283392d1f3bd16ac31347e1c3ac OR js_sha256:bce41e30b5e356f4a6e0d4ef8dec12a5f5ae941368d760696d31d17e0d33629b OR js_sha256:246e94baca7ed6d359017dca2e2355529aad83bca6453f5622e9b06825b86fd0

Provenance

Added: 2026-09-23 13:19
Matches pages whose traffic triggers the Emerging Threats "AMOS ClickFix Campaign" signatures, or that loaded one of the four known loader builds (t.4b1009ff6c3f.js, and ext-b.4f9db6afd06a.js / ext-b.bce41e30b5e3.js / ext-b.246e94baca7e.js). The fingerprinting stage is rebuilt every few days, so new ext-b builds will appear. The /t.js?site= value identifies the compromised website and stays the same when the attacker domain rotates. Some public lists label the attacker domains ClearFake; several compromised sites also carry a separate ClearFake injection, so a page can match both.
References:

Sightings (66)

HostScanScriptMatchWhen
anukunj.com2d036528…—query2026-09-30 01:49
driftwoodresortmn.com77c7f38b…—query2026-09-23 13:23
futurex.media5e5aef27…—query2026-09-23 13:23
ar2arquitetura.com.brf3742daf…—query2026-09-23 13:23
uarts.education6a7e15f8…—query2026-09-23 13:23
21-realty.comcffe7b24…—query2026-09-23 13:23
bmcsolutions.netff5ccee0…—query2026-09-23 13:22
candleofhope.usa7961a3a…—query2026-09-23 13:22
contentcareer.com8cb96fe2…—query2026-09-23 13:22
beatrizmontes.comb8847741…—query2026-09-23 13:22
davariyabrothers.com09d57c04…—query2026-09-23 13:22
ambiancewax.comec4fc1b7…—query2026-09-23 13:22
browningconsultingtexas.comb11194ac…—query2026-09-23 13:22
alnahreengroup.com44cdc9a4…—query2026-09-23 13:22
okakademi.comed22b657…—query2026-09-23 13:21
flowplanet.world1ee6a8b8…—query2026-09-23 13:21
alholol-almobtakara.comf3b35f1c…—query2026-09-23 13:21
autocentarjana.com2070e372…—query2026-09-23 13:21
pacharagems.com0ca60b62…—query2026-09-23 13:21
soochi.com.vn830266b5…—query2026-09-23 13:21
zenteambuilding.com268b8898…—query2026-09-23 13:21
altanomea.com.brbd35e055…—query2026-09-23 13:21
idonialuxe.com263206d3…—query2026-09-23 13:20
saggang.com1133dc37…—query2026-09-23 13:20
firstpandr.orgd700e7e5…—query2026-09-23 13:20
cookwithlina.comab7200b9…—query2026-09-23 13:20
sportsministry.infoa4d1d61d…—query2026-09-23 13:20
editions-canaima.comc57cb5b9…—query2026-09-23 13:20
naturfotografie-roman-vitt.deb261c3fc…—query2026-09-23 13:20
skskusy.pl56d3c517…—query2026-09-23 13:20
americandreamlost.com7a4aadbf…—query2026-09-23 13:20
littleolange.com399275d6…—query2026-09-23 13:20
coolplace.biz379a4850…—query2026-09-23 13:20
etigroup.inc7314afc…—query2026-09-23 13:20
mrpiccam.com093e9984…—query2026-09-23 13:20
ongwafy.com455ea5ef…—query2026-09-23 13:20
lagospark.comdf2e120b…—query2026-09-23 13:20
alkoseal.com9cc1d57e…—query2026-09-23 13:20
drjanetlittlespeaks.com9db6b97b…—query2026-09-23 13:20
capecoralburrowingowls.com162a3322…—query2026-09-23 13:20
pdf2printperfect.com01a9e484…—query2026-09-23 13:20
briwonacademy.com6ffc1da8…—query2026-09-23 13:20
becrepress.com95c2e99a…—query2026-09-23 13:20
asraralmudha.com9d105866…—query2026-09-23 13:20
dyshatilo.com.ua68814cb7…—query2026-09-23 13:20
marathonspiritueldefes.com8dd25257…—query2026-09-23 13:20
firstpandr.orgc7487216…—query2026-09-23 13:20
thegearmesh.comc7a2e1ba…—query2026-09-23 13:20
andiamoinitalia.es5638be19…—query2026-09-23 13:20
newvillarental.comef5155a4…—query2026-09-23 13:20
monocafe.com.pl5cef15d1…—query2026-09-23 13:20
farnostprerov.cz1d979d45…—query2026-09-23 13:20
antivirusprogram.org55fb1058…—query2026-09-23 13:20
santamonicaconsultoria.com.brfc122e8a…—query2026-09-23 13:20
tobiasemanuel.org429a2597…—query2026-09-23 13:20
romanchassis.com918cf92e…—query2026-09-23 13:20
multi-sweep.com5d371917…—query2026-09-23 13:20
duldulsports.com.pk854729a8…—query2026-09-23 13:20
americandreamlost.com2c1a021f…—query2026-09-23 13:20
longitudeconstruction.come8c7b1b7…—query2026-09-23 13:20
dibellaorologi.itbcdba16f…—query2026-09-23 13:20
gowcar.com88eea211…—query2026-09-23 13:20
saggang.come25fcbb6…—query2026-09-23 13:20
medprov.comc020e9a8…—query2026-09-23 13:20
corrieredellaverita.it8bb233fb…—query2026-09-23 13:20
condominiojavieracarrera.cla4a304ea…—query2026-09-23 13:19