loop-lumen.com: a Mac stealer download site (AMOS, ClickFix) and what to do if you pasted its command

What loop-lumen.com is, and what we know about it

loop-lumen.com is not a program on your Mac. It is a web address that the abuse.ch project URLhaus lists as a place where Mac malware was served. There is no public write-up of this one site that we could find, so what follows is what URLhaus shows, what we saw ourselves, and what security vendors have published about the malware family it is tagged with.

1. 1

   What URLhaus lists

   Three file addresses on loop-lumen.com, all in a folder called zxc and all added on 9 September 2026: app.zip, apptwo.zip and appex.zip. Each carries the same five tags: amos, macos, stealer, wallet-hijack and ClickFix. The reporter is anonymous. URLhaus marks app.zip as online and the other two as offline.

2. 2

   What the tags mean

   amos is the Atomic macOS Stealer, a password and wallet thief for Macs. ClickFix is a trick in which a fake verification page makes you run a command yourself. macos says the target is the Mac. wallet-hijack is the reporter's own label; URLhaus gives no explanation, but vendors describe AMOS swapping hardware-wallet apps for fake ones, which fits it.

3. 3

   What we could not confirm

   We did not download the zip files and we did not see the page that tells visitors to paste a command. So we do not know what lure loop-lumen.com used, what exactly is inside the zip files, or whether anything on Windows is affected. The AMOS label is the reporter's tag; URLhaus shows no malware signature for the file.

4. 4

   What this means for you

   If you only saw the name in a log, a link or a warning, you are not infected by that alone. The risk is for people who downloaded something from the site or pasted a command it showed them into Terminal on a Mac.

Kind of threat

A malware download site for macOS; the malware is tagged as the Atomic macOS Stealer (AMOS)

Delivery trick

ClickFix: a fake verification page that asks you to copy a command and paste it into Terminal

Domain registered

1 September 2026, expires 1 September 2027, registrar Dominet (HK) Limited (RDAP, read 6 October 2026)

URLhaus entries

3 file addresses, all added 9 September 2026; 1 online, 2 offline when we read the page

Hosted behind

Cloudflare: both addresses URLhaus saw for the domain belong to Cloudflare, so the real server is not visible

Platform

macOS, by the tags. Whether Windows, iPhone or Android are hit is not stated by any source we read

What we checked on 6 October 2026, and what we could not

We opened loop-lumen.com once, from Lithuania, in an automated Chromium browser set to English. The site did not load: Cloudflare answered with a 520 error. That tells you nothing good about the site, and it clears nothing.

What happened to loop-lumen.com, from registration to our test

The timeline is short: the domain is five weeks old. The dates come from RDAP and from the URLhaus pages for the host and for app.zip.

1. 1 September 2026

   The domain is registered

   RDAP shows loop-lumen.com registered on 1 September 2026 through the registrar Dominet (HK) Limited, valid until 1 September 2027. URLhaus records the registration at 11:02 UTC the same day.

2. 9 September 2026

   Three malware URLs are reported

   At about 15:59 UTC an anonymous reporter adds app.zip, apptwo.zip and appex.zip, all under the folder zxc, with the tags amos, macos, stealer, wallet-hijack and ClickFix. This is the first time URLhaus sees the host.

3. 10 September 2026

   URLhaus fetches a file and complains to Cloudflare

   URLhaus retrieved a zip file from app.zip, with the SHA-256 beginning f8d09bb7, shortly before 05:00 UTC. It has no malware signature and no VirusTotal result on the page. At 04:47 UTC an abuse complaint was sent to Cloudflare's abuse address.

4. 6 October 2026

   Still listed, and our test gets a 520

   URLhaus shows app.zip as online and says it has spread malware for more than 26 days. Our browser test the same day reaches only Cloudflare's error page.

   

How the ClickFix trick works on a Mac

ClickFix does not use a security hole. It makes you do the infecting yourself, so your Mac's own warnings are part of the "instructions" you ignore. We did not see loop-lumen.com's page; this is how Kaspersky, Malwarebytes and Unit 42 describe the trick on Macs.

1. 1

   You land on a page with a check

   It looks like a CAPTCHA, a human check, a browser fix or an install guide. Malwarebytes documented a fake Cloudflare check; Unit 42 documented a "macOS toolkit" quick-setup page. Both end with a command to copy.

2. 2

   It tells you to open Terminal

   The Mac version of the instructions is: press Command + Space, type Terminal, paste the command and press Return. Kaspersky describes the same scene and notes the Windows version uses the Run window instead.

3. 3

   The command downloads the real malware

   What you paste is a short line that fetches a script from the attackers' server. Kaspersky describes one variant that pulls a disk image to the /tmp folder under a random name, mounts it without showing it in Finder and launches the app inside. Unit 42 describes a variant that pulls a Zsh script, which unpacks a second script and a Mach-O program.

4. 4

   A password box appears

   Kaspersky, Sophos and Unit 42 all describe a fake macOS password prompt. If you type your Mac password, the malware can use it to act as an administrator. Sophos adds that AMOS repeats the prompt until you give a correct password.

5. 5

   Nothing seems to happen

   That is the point. A Terminal window that closes, or a CAPTCHA that never finishes, is the whole experience for most victims. Unit 42 saw Terminal ask for access to Finder, Desktop, Documents and Notes during the infection.

Unit 42 points out that a "quick setup" page like the toolkit one is not strictly ClickFix, because ClickFix usually poses as a check to reach a site you wanted; the copy-and-paste step and the result are the same.

What AMOS (Atomic macOS Stealer) is

AMOS is a ready-made password and wallet stealer for Macs that criminals rent or buy. The sources agree on the basics and differ on dates and on what each version does.

What AMOS steals from a Mac

The list is long because AMOS collects everything it can find in one sweep and zips it for the attackers. Each item below is named by at least one of the sources; no single report lists all of them.

What this can cost you

Reading the site or seeing its name costs nothing. The risks below apply to a Mac where the command was pasted or the zip was opened.

• High

  Account takeover

  Cookies and session tokens let someone use your logged-in email, social and work accounts without your password. Sophos calls the goal rapid account takeover.

• High

  Crypto theft

  Wallet files and seed phrases are the main prize. The wallet-hijack tag and the fake Ledger and Trezor apps point at the same thing. Stolen crypto cannot be reversed; Ledger says only law enforcement can pursue it.

• High

  Your Mac password in the attackers' hands

  The malware asks for it and keeps it. With it, an attacker can open the Keychain and approve actions on that Mac, so changing it matters as much as changing the web passwords.

• Medium

  Keys and tokens from your work

  Unit 42 saw cloud, container and file-transfer config folders taken. If you are a developer, keys and API tokens on the Mac are exposed.

• Medium

  A hidden program that starts again

  Sophos and Unit 42 describe AMOS leaving programs in hidden folders that start at login or boot. Until they are gone, the Mac keeps talking to the attackers.

• Low

  Nothing, if you only saw the name

  A name in a warning, a firewall log or a blocked link is not an infection.

What you may notice, and what you may not

Most victims notice nothing. The signs below are the ones the reports describe, and the first three happen during the infection, not after it.

How people end up on a page like this

We do not know how visitors reach loop-lumen.com, and no source says. The routes below are the ones the sources name for AMOS and for ClickFix on Macs.

1. 1

   A fake human check on a site you wanted

   A hacked or fake page shows a CAPTCHA and sends you on. Kaspersky and Malwarebytes describe this form.

2. 2

   A malicious ad or a search result

   Unit 42 says AMOS has been spread through malicious ads. Huntress documented chat-answer links from ChatGPT and Grok that led to AMOS, and Sophos names AI-themed lures as a trend.

3. 3

   A cracked or free copy of Mac software

   Trend Micro traced one AMOS campaign to a site hosting cracked Mac apps, and Unit 42 saw cracked-software and fake toolkit pages.

4. 4

   A link in an email or message

   In a different Mac stealer case, Huntress says the victim followed a link in an email. That was not AMOS, but the route is the same.

5. 5

   A download you started

   The three URLhaus files are zip archives. Opening a downloaded zip that claims to be an app is the other way in.

Check your Mac before you delete anything

Start with the question that matters: did you paste a command from a website into Terminal, or open a zip from loop-lumen.com? If yes, stop here and follow the numbered plan on this page (the Mac plan), because a clean-looking check does not clear a Mac. If you are not sure, do these checks first. None of them deletes anything.

While you check, stop using the Mac for banking, email, work or crypto, and disconnect it from Wi-Fi and network cables if you can: Malwarebytes tells people who ran such a command to stop sensitive use at once, and Huntress says the machine should be isolated.

1. 1

   Look at what you pasted

   Open Terminal and scroll up in its window to see earlier commands. Do not run them again. Be warned that Huntress saw a different Mac stealer's command erase the Terminal history, so an empty history proves nothing.

2. 2

   Open the folders other reports found

   In Finder choose Go > Go to Folder and type a path, as Apple's help describes. Try ~/Library/Application Support/ and look for hidden folders starting with a dot: .com.apple.accountsd and .com.apple.metadata.mds (Unit 42). Hold Option and open the Go menu to see Library (Apple's tip).

3. 3

   Look for files in your home folder

   Sophos and Huntress list names such as .helper, .pass, .agent and .mainhelper in the home folder, and /Library/LaunchDaemons/com.finder.helper.plist. In Terminal, ls -la ~ lists hidden files; it only lists. These names come from other versions of the malware, so a match is a strong sign and no match does not clear the Mac.

4. 4

   Look at Login Items and background items

   Open Apple menu > System Settings > General > Login Items & Extensions. Apple says this is where apps allowed to run in the background are listed. Look for names you did not install, including names that copy Apple's, such as softwareupdate, accountsd or mdworker.

5. 5

   Look at running processes

   Open Activity Monitor (Applications > Utilities). Apple's guide shows how to sort by CPU and quit a process. Names that imitate Apple's, such as AccountsHelper or mdworker_shared in Unit 42's test, are worth noting, but do not guess: write them down before quitting anything.

6. 6

   Look in /tmp and the LaunchAgents folder

   Malwarebytes suggests checking /tmp and ~/Library/LaunchAgents. Unit 42, Huntress and Sophos name the other paths above. Huntress says that for the malware it studied, deleting the leftover files was enough and it did not return. That was a different malware, so do not take it as proof for this one.

7. 7

   Check your accounts

   Look at the sign-in activity of your email, Apple Account, banks and exchanges for places and devices you do not know. Look at your crypto balances. This is quicker than any file check.

8. 8

   A scan helps, but it does not clear the Mac

   A scan with a Mac security product can find known files. Treat a clean result the way you treat a clean site test: one data point. Do not rely on it to say the Mac is safe. No vendor publishes a removal procedure we could test for this site's file and we did not infect a Mac, so the order of the plan is our judgement from Malwarebytes, Huntress and Apple's pages, not a tested result.

If you use Windows, an iPhone or an Android phone

The tags and every source we read describe a Mac threat. We found nothing that says the three loop-lumen.com files run on anything else.