Blockchain-Backed Infostealer Campaign Uses Suspected ClickFix Lures and Trusted Services

Darktrace reported a blockchain-backed infostealer campaign affecting Windows and macOS devices in customer environments across Europe, the United States, Asia, and the Middle East. Initial access likely involved ClickFix social engineering, followed by malware delivery and command-and-control activity using public blockchain infrastructure, legitimate services, and algorithmically generated domains. The activity was associated with Atomic macOS Stealer (AMOS), Lumma, Rhadamanthys, Vidar, and Phexia, with credential and cryptocurrency theft assessed as the apparent objectives. A significant proportion of affected devices also contacted cryptocurrency-mining infrastructure, indicating active cryptomining.

Separately, Mandiant’s reporting on UNC5142 and EtherHiding documented CLEARSHORT-related hosting infrastructure observed from December 2024 through May 2025. It relied heavily on Cloudflare Pages, alongside Backblaze B2 and other domains, with names impersonating CAPTCHA verification, security checks, and macOS browser updates. Frequent hosting changes and recurring naming patterns illustrated the campaign’s evolving delivery infrastructure; the supplied evidence does not establish that it was the same operation Darktrace observed. Defenders should correlate connections to trusted hosting and blockchain services with repeated beaconing, unusual TLS traffic, suspicious downloads, and mining activity rather than treating service reputation alone as evidence of safety.