Active Malware-as-a-Service (MaaS) campaign utilizing the "ClickFix" social engineering framework to distribute the Atomic macOS Stealer (AMOS) / MacSync. The threat actor is exploiting high-traffic WordPress websites (e.g., web.hypothes.is, unitedwaynca.org) by injecting a redundant, two-stage loader.

The initial loader utilizes strict Traffic Delivery System (TDS) filtering, only serving the payload to macOS users originating from residential or cellular IP addresses to evade automated datacenter scanning. Once triggered, a fake Cloudflare "Verify you are human" modal is rendered. Clicking "Copy" on this modal uses clipboard hijacking to execute a fileless Base64 payload via the macOS Terminal.

Owners of compromised sites serving malware include Hypothesis and United Way.

Full technical analysis and verification methodology: https://open.substack.com/pub/defensendepth/p/the-ghost-in-the-annotations

Indicators of Compromise (IoCs)