The Dark Side of “I’m Human” Clicks: How Atomic macOS Stealer is Hijacking Apple Users Through Fake CAPTCHAs 🍎💀

A deep dive into the latest ClickFix campaign targeting macOS users with sophisticated social engineering tactics

We’ve all been there — clicking that familiar “I’m not a robot” checkbox dozens of times a day. It’s become second nature, part of our digital muscle memory. But what if I told you that cybercriminals are now weaponizing this very habit to steal your most sensitive data?

Welcome to the world of ClickFix attacks, and specifically, a sophisticated new campaign that’s targeting macOS users with the notorious Atomic macOS Stealer (AMOS). 🎯

The Spectrum of Deception 📡

CloudSEK researchers recently uncovered a particularly cunning malware campaign that’s making waves in the cybersecurity community. The attackers have chosen an interesting target: customers of Spectrum, the major U.S. telecommunications provider. But here’s the twist — they’re not just phishing for credentials. They’re going much deeper.

The campaign operates through typosquat domains that closely mimic legitimate Spectrum websites:

• panel-spectrum[.]net
• spectrum-ticket[.]net