Do Son 
A flowchart of the infection chain | Image: NetbyteSEC
At a glance
| Factor | Details |
|---|---|
| Malware Family | AMOS (Atomic macOS Stealer), Light Stealer, and XMRig miner |
| Threat Actor | Unconfirmed cybercrime operator (Tracked via Polygon wallet) |
| Target or Victims | macOS users, cryptocurrency holders, and developers |
| Delivery Vector | ClickFix fake CAPTCHA lure on Cloudflare Pages |
| Key Capabilities | EtherHiding blockchain C2 resolution, credential theft, crypto wallet draining, cryptomining |
| Source | NetbyteSEC Research Team |
TL;DR
A newly discovered macOS ClickFix malware campaign tricks users into running malicious shell scripts through deceptive verification prompts. The operators hide their command infrastructure on the Polygon blockchain to evade standard domain blocking. Once installed, the modular backdoor deploys the Atomic macOS Stealer and Monero cryptominers to hijack host resources.
Delivery
The intrusion begins when a user lands on a deceptive webpage hosted on Cloudflare Pages. The page displays a fake verification gateway named TrustKey that mimics standard human verification challenges. Victims see a simple checkbox labeled “I’m not a robot.”
When the visitor clicks the checkbox, the page copies a base64-encoded command directly to the clipboard. At the same time, the website displays detailed instructions. It prompts the user to open the macOS Terminal app and paste the copied text.
As researchers from NetbyteSEC explained, “ClickFix deceives users into executing malicious commands themselves.”
By convincing victims to run the command, the attacker bypasses macOS Gatekeeper protections. The clipboard command fetches a payload from a Cloudflare Worker using curl and executes it immediately in memory.
Infection Chain
The downloaded payload executes via the macOS-native osascript command-line utility. First, the script unpacks several nested layers to establish persistence on the local file system.
The malware writes a custom LaunchAgent configuration file into the user Library folder. It sets both the RunAtLoad and KeepAlive keys to true. Consequently, the operating system executes the malicious background script on every startup and restarts it if terminated.
To evade static signature detectors, the loader constructs all strings using character-by-character string building and numeric junk. Once the script resolves its hidden strings, it initiates contact with the blockchain.
Command-and-Control and EtherHiding Mechanics
The backdoor resolves its remote server using an evasion technique known as EtherHiding. Instead of hardcoding a domain name, the script queries public Polygon blockchain RPC endpoints.
The loader executes a read-only smart contract call to retrieve the active server address. NetbyteSEC noted that “The live C2 hostname is stored on Polygon and can be fetched at runtime.”
This design prevents security defenders from blocking static domains embedded in malware samples. Because the contract call requires no gas fees, the read operation creates no on-chain footprint.
However, this technique also provides an advantage to defenders. As NetbyteSEC observed, “Because every C2 rotation is a transaction, and transaction calldata lives in the blockchain forever, the contract hands us the operator’s entire operational history.”
Analysts decoded past blockchain transactions to trace the operator’s infrastructure history. The wallet rotated through multiple inexpensive domains over several months. Furthermore, on-chain records showed that the attacker funded the deployment wallet using transfers from a public cryptocurrency exchange hot wallet.
On-Demand Payloads and Data Exfiltration
After registering the infected host, the persistent backdoor agent polls the server every 60 seconds. The server returns instructions to download modular payloads on demand.
First, the operator deploys a full version of the Atomic macOS Stealer, identified internally as the NITRO build. The stealer targets 22 desktop cryptocurrency wallet applications, including Exodus, Electrum, Wasabi, and Bitcoin Core. In addition, it scans browser directories for 193 specific cryptocurrency extension IDs.
The stealer also abuses the macOS Keychain to harvest stored browser encryption keys. It presents repeated fake system dialogs to trick the victim into entering their administrative password. When the victim enters their password, the malware stores it in a local file.
Subsequently, the malware packages stolen credentials and wallet directories into an archive using the native ditto utility. It then exfiltrates the compressed file to external servers using curl.
In addition to theft modules, the attacker can deploy an XMRig cryptominer. The script downloads a clean XMRig binary directly from GitHub to evade signature detection. It removes Gatekeeper quarantine attributes and mines Monero, causing high processor usage and rapid battery drain.
Defense and Detection Guidance
Remediating this macOS ClickFix malware infection requires removing the root persistence agent. Security analysts must delete the malicious LaunchAgent plist file and terminate the associated osascript background process.
NetbyteSEC emphasized this remediation rule: “Persistence is carried entirely by the agent’s LaunchAgent… kill the agent, not just the miner.” If administrators remove only the mining binary, the agent will simply redownload the miner.
Organizations must train users never to paste terminal commands from untrusted websites. Security teams should monitor macOS endpoints for unusual osascript activity and outbound RPC queries to public blockchain gateways.
Defenders can read the full NetbyteSEC technical teardown of the macOS ClickFix crimekit to inspect detailed indicators and network rules. Implementing strict terminal execution controls ensures protection against this evasive macOS ClickFix malware campaign.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
