The “ClearFake” malicious browser update campaign has continued its spread and is now targeting macOS devices with Atomic Stealer (AMOS) malware. According to researcher Randy McEoin, the ClearFake campaign began back in July of 2023. ClearFake is using non-obfuscated JavaScript on a variety of websites to create a fake pop-up window that informs the user they need to download the latest version of Google Chrome for security updates. This tricks users into thinking they need to download browser updates, thereby causing the victims to download malware and other targeted payloads. The original malware was using JavaScript to create the fake pop-up and a clickable button that redirected users to a malicious OneDrive file that would load the Amadey trojan to the device. As of November 17, 2023, the ClearFake campaign has expanded to include macOS devices by employing the same tactics previously seen targeting Windows devices. JavaScript is used to create a fake webpage that implores the user to download the latest Safari web browser version, but it instead deploys a payload of Atomic, an information stealing piece of malware. Atomic is capable of harvesting numerous pieces of information from a victim device, including passwords and credit card information stored in browser, crypto currency files, keychain passwords, financial information, and even WiFi passwords. Bleeping Computer reports that approximately 50% of antivirus software is still struggling to identify Atomic once loaded. CTIX analysts will continue to provide updates and monitor the situation and malware payloads utilized by ClearFake.