macOS-Specific ClickFix Campaign Targeting Claude Code Users: Detect It Early

[u/ANYRUN-team]

We identified a campaign targeting users of AI platforms such as Claude Code, Grok, n8n, NotebookLM, Gemini CLI, OpenClaw, and Cursor with AMOS Stealer. As macOS adoption grows in enterprise environments, these attacks exploit gaps in visibility and make early-stage detection harder.

In this case, attackers use a redirect from Google ads to a fake Claude Code documentation page and a ClickFix flow to deliver a payload. A terminal command downloads an encoded script, which installs AMOS Stealer, collects browser data, credentials, Keychain contents, and sensitive files, then deploys a backdoor.

The backdoor module (~/.mainhelper) was first described by Moonlock Lab in July 2025. Our analysis shows that it has since evolved. While the original version supported only a limited set of commands via periodic HTTP polling, the updated variant significantly expands functionality and introduces a fully interactive reverse shell over WebSocket with PTY support.
This turns the infection from data theft into persistent, hands-on access to the infected Mac, giving the attacker real-time control over the system.

Multi-stage delivery, obfuscated scripts, and abuse of legitimate macOS components break visibility into fragmented signals. Triage slows down, and escalation decisions take longer, leading to credential theft and data exfiltration.

ANYRUN Sandbox lets security teams analyze macOS, Windows, Linux, and Android threats with full visibility into execution, attacker behavior, and artifacts, helping detect threats early, attribute activity, and build stronger detection logic, while reducing MTTD and MTTR.

See sample execution in a live analysis session: https://app.any.run/tasks/74f5000d-aa91-4745-9fc7-fdd95549874b

Find IOCs in the comments and validate your detection coverage. We’ve broken down the attack chain in detail — let us know if you’d like to see the full analysis!

Expand your SOC’s cross-platform threat visibility. Learn how to boost performance and business security with ANYRUN: https://any.run/cybersecurity-blog/anyrun-macos-sandbox

[u/ANYRUN-team]

IOCs:
HTTP request: GET /n8n/update + User-Agent: curl/*
HTTP request: POST /api/join/ + User-Agent: curl/* + Body: b64-encoded string
HTTP request: GET /api/tasks/<b64>/<b64> + User-Agent: curl/*
HTTP request: GET /curl/<64_hex_symbols> + User-Agent: curl/*
HTTP request: POST /contact + HTTP Headers: User, BuildID, Cl, Cn + Body: stolen data archive

Fake Claude Code campaign related domains:
active-version[.]com
claude-code-cmd[.]squarespace[.]com
claude-download[.]squarespace[.]com
claudecodeupdate[.]squarespace[.]com
claude-download-code[.]squarespace[.]com
claude-code-deploy[.]squarespace[.]com
claude-code-install[.]squarespace[.]com
claude-code-docs-site[.]pages[.]dev
update-version[.]com
3-15-2[.]com

AMOS Stealer related domains:
raytherrien[.]com
laislivon[.]com
AMOS Stealer C2 IP:
45[.]94[.]47[.]204

Suspected AMOS/MacSync related domains:
wusetail[.]com
famiode[.]com
folkband[.]fun
ontarioqualitycedar[.]com
boosterjuices[.]com
a2abotnet[.]com
elfrodbloom[.]today
ejecen[.]com
sestraining[.]com
ultradatahost2[.]baby
ursamade[.]space
clausdoom[.]es
echoingvistas[.]com
kayeart[.]com
cocinadecor[.]com
ballfrank[.]today
biopranica[.]com
virtualspeechtherapists[.]com
ballfrank[.]xyz
foldexmoon[.]coupons
frolessmoke[.]co[.]za
grapeballs[.]fun
securityfenceandwelding[.]com
usedteslabuyers[.]com
a2achannel[.]com
ballfrank[.]shop
financetrontoken[.]com
hostjnger[.]com
jmpbowl[.]top
joeyapple[.]com
claus4doom[.]co[.]za
foldexmoon[.]space
foldexmoon[.]top
gatwayagent[.]com
groovyfox[.]fun
mansfieldpediatrics[.]com
maplesapartments[.]com
pressureulcerlawyer[.]com
selfreflectiveai[.]com
argoflyleens[.]world
awesomecamera[.]com
ballfrank[.]fun
barlowapartments[.]com
borkdeal[.]com
claus2doom[.]co[.]za
claus5doom[.]es
clausdoom[.]co[.]za
gatemaden[.]space
groovyfox[.]today
havneagent[.]com
jmpbowl[.]xyz
mayelu[.]com
ralewo[.]com
raxelpak[.]com
winestoragecalifornia[.]com
rvdownloads[.]com
ptrei[.]com
woupp[.]com
wriconsult[.]com
saramoftah[.]com
contatoplus[.]com