CLICKFIX/macOS Infostealer
DAY NIGHT
TLP:AMBER Threat Intelligence Dossier· 2026-06-04·Security

Cloudflare ClickFix" macOS infostealer

A pasted Terminal command that quietly empties a Mac: Keychain, browser sessions, and crypto wallets, then stays resident. Reverse-engineered, attributed, and turned into detections.

SeverityHIGH
ClasseCrime / Infostealer MaaS
FamilyAMOS / Odyssey cluster
PlatformmacOS (Intel + Apple Silicon)
TechniqueClickFix (T1204.004)
01

Bottom line up front

What it is, who runs it, and why it matters.

The captured command is the first stage of a macOS information stealer delivered through the ClickFix social-engineering technique: a fake Cloudflare "Verify you are human" page that tricks the victim into pasting a command into Terminal.

It is not nation-state APT activity. It is financially-motivated eCrime: an affiliate of a macOS infostealer Malware-as-a-Service operation in the Atomic macOS Stealer (AMOS) / Odyssey lineage.

The objective is theft of credentials, browser sessions, Keychain secrets, and cryptocurrency wallets, then system-level persistence for resale and long-term access. The whole chain after the paste is autonomous: the victim only pastes the command and types a password into a fake prompt.

For a developer-heavy org with cloud and crypto exposure, treat any confirmed execution as a credential-compromise incident: rotate everything reachable from that host, including AWS keys and SSO sessions.

Activity classeCrime, not APT
DeliveryClickFix paste
GateHMAC-signed fetch
Stage 2Mach-O stealer
Paste to exfilunder 1 to 2 min
02

Sample fingerprint

Indicators confirmed for this sample. Block and hunt these now. Click an icon to copy.

VirusTotal note: the report you linked is the URL analysis for api.ketoriloxisd[.]com/GpZcowV4DCvwthe1. Confirmed: the SHA-256 of that URL equals the VT identifier 9ecdf6a4...a5ea2e73. Live vendor verdicts could not be read from this environment (the VT page is JavaScript-rendered); check the live page before quoting a detection count.

03

Kill chain: phases, autonomy & timeline

How it unfolds. Teal = a human must act. Amber = the malware acts alone. Click any phase to expand.

2
human actions required
paste the command, type the password
10
fully autonomous phases
discovery, theft, exfiltration, persistence, cleanup
Filter:
04

MITRE ATT&CK (macOS)

Tactics and techniques observed across the chain. Hover any technique for detail.

05

Indicators & behaviors

Confirmed indicators, related-cluster indicators (broad hunting only), and behavioral IOAs.

06

Detection & threat hunting

Mapped with the applicable security tooling. ● primary   ● indirect   ● delivery vector   ● config only

Queries contain live indicator strings so they actually match. Adjust field names to your schema.

07

Related campaigns & family evolution

The AMOS / Odyssey cluster and the 2026 shift to signature-gated loaders. Each card links to source.

08

Impact & end objective

What the operator was trying to achieve.

▲ End objective

Monetize the victim. Drain crypto wallets directly, resell credentials and live browser sessions on stealer markets, and keep a persistent foothold for re-infection or follow-on intrusion into corporate cloud and SaaS.

  • Credential theft: browser logins and autofill, Keychain items, login.keychain-db, crypto wallet credentials.
  • Session hijack: stolen cookies bypass MFA on already-authenticated accounts (email, code hosts, cloud consoles, SaaS).
  • Direct financial theft: desktop and extension wallet data, plus trojanizing Ledger Live to capture future wallet activity.
  • Data exfiltration: Apple Notes, screenshots, and up to ~10 MB of Desktop and Documents files (keys, kdbx, pdf, docx).
  • Persistence and reinfection: a system LaunchDaemon survives reboot and can re-pull payloads or hand access to other actors.
  • Lateral / cloud pivot: harvested AWS keys, SSO tokens, and GitHub credentials enable movement off the endpoint into your estate.
09

If execution is confirmed on a Mac

Containment and recovery, in order. Preserve evidence before you wipe.

  1. Isolate the host via Jamf Protect or SentinelOne network quarantine. Do not reimage yet: preserve /tmp/lema-noka*, /tmp/out.zip, the LaunchDaemon plist, and unified logs first.
  2. Treat as credential compromise. From a clean device, rotate macOS login and Keychain, all browser-saved passwords, SSO sessions, AWS keys and tokens, VPN, GitHub tokens, and any crypto wallet seeds.
  3. Pull the binary (/tmp/lema-noka/lema-noka) for static triage. Do not execute. Hash it, extract strings, confirm the embedded api.ketoriloxisd[.]com C2 and any further infrastructure.
  4. Block ketoriloxisd[.]com and all subdomains at DNS, proxy, firewall, and Route 53 DNS Firewall.
  5. Remediate persistence: remove the com.<digits>.plist LaunchDaemon, verify or replace /Applications/Ledger Live.app, then rebuild the host if integrity cannot be assured.
  6. Hunt fleet-wide with the queries in section 06 before closing the incident, and check GuardDuty / Wiz for cloud-side abuse of any credentials that lived on the host.

Assumptions

  • The Homebrew path and Mach-O binary confirm a macOS target. The binary lema-noka is the second stage and was not in the pasted command, so its exact capabilities are inferred from the AMOS / Odyssey family, not directly observed.
  • This is analysis on your side, not a confirmed live compromise of an endpoint, unless you indicate otherwise.
  • Second-stage behavior is mapped from the closest documented family samples; this specific build may differ in detail.
  • Hunting queries assume macOS telemetry reaches SentinelOne and/or Jamf Protect, and that DNS / proxy and EDR events are forwarded to Sumo Logic.
  • Related-cluster IOCs are for broad hunting and are explicitly not confirmed indicators of this specific intrusion.

Non-obvious follow-up angles

The Claude Code docs clone

One sibling family (MioLab) was distributed via a cloned Claude Code documentation site. Your org runs Claude Enterprise and Bedrock, and your engineers are exactly the developer audience these lures target. Worth a focused watch on typosquats of your AI and dev tooling.

HMAC secret as a pivot

You hold the access key and download secret. In a sanctioned, legal-cleared exercise these could fingerprint the operator delivery infra, but doing so actively touches attacker servers and must route through IR and legal first.

Automate the hunt

Wrap section 06 into an n8n flow: schedule the S1 and Sumo queries, auto-block new ketoriloxisd-style domains via DNS Firewall, and open a ticket on any hit.

For internal defensive use. Analysis of attacker-delivered code for detection engineering and incident response. No malware was executed in producing this brief.