Ankura CTIX FLASH Update - November 28, 2023

Ransomware/Malware Activity

macOS Targeted with Atomic Stealer Malware in ClearFake Campaign

The "ClearFake" malicious browser update campaign has continued its spread and is now targeting macOS devices with Atomic Stealer (AMOS) malware. According to researcher Randy McEoin, the ClearFake campaign began back in July of 2023. ClearFake is using non-obfuscated JavaScript on a variety of websites to create a fake pop-up window that informs the user they need to download the latest version of Google Chrome for security updates. This tricks users into thinking they need to download browser updates, thereby causing the victims to download malware and other targeted payloads. The original malware was using JavaScript to create the fake pop-up and a clickable button that redirected users to a malicious OneDrive file that would load the Amadey trojan to the device. As of November 17, 2023, the ClearFake campaign has expanded to include macOS devices by employing the same