EXECUTIVE SUMMARY:
A macOS ClickFix campaign uses social engineering to trick users into executing malicious commands through Terminal under the guise of a fake human-verification page. The attack presents a convincing CAPTCHA-style prompt that instructs victims to open Terminal and paste a supposedly legitimate verification command. Instead, the command retrieves malicious content from a Cloudflare Worker and launches an AppleScript-based infection chain. The campaign combines ClickFix social engineering with EtherHiding, allowing attackers to conceal command-and-control information inside a Polygon smart contract rather than embedding a fixed C2 address in the malware.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
A macOS ClickFix campaign uses social engineering to trick users into executing malicious commands through Terminal under the guise of a fake human-verification page. The attack presents a convincing CAPTCHA-style prompt that instructs victims to open Terminal and paste a supposedly legitimate verification command. Instead, the command retrieves malicious content from a Cloudflare Worker and launches an AppleScript-based infection chain. The campaign combines ClickFix social engineering with EtherHiding, allowing attackers to conceal command-and-control information inside a Polygon smart contract rather than embedding a fixed C2 address in the malware.[emaillocker id="1283"]
The infection begins with a fake human-verification page that instructs the victim to open Terminal and paste a supposed verification token. The clipboard content actually executes a curl request that retrieves malicious code from a remote server and pipes it directly into Bash. The downloaded payload uses macOS osascript to execute Base64-encoded AppleScript, establish a LaunchAgent for persistence, and conceal sensitive strings through character-by-character obfuscation. The loader subsequently queries a Polygon smart contract through public RPC endpoints to dynamically obtain the C2 hostname, a technique known as EtherHiding that prevents the C2 address from being hardcoded in the malware. The persistent backdoor fingerprints the compromised host, repeatedly resolves the C2 address, prompts the victim for their macOS password through a fake system dialog, resets privacy controls, and periodically polls for commands. Depending on the received instructions, it can deploy an Atomic macOS Stealer (AMOS) payload, a lightweight stealer, an XMRig cryptocurrency miner, or an interactive remote shell. The stealer targets browser credentials, cookies, cryptocurrency wallets, browser extensions, macOS Keychain data, application information, and files from common user directories before compressing and exfiltrating the collected information.
The campaign demonstrates how ClickFix can bypass conventional download-based security controls by manipulating users into executing trusted macOS utilities themselves. The use of blockchain-based C2 resolution further complicates traditional domain-based blocking because infrastructure can be rotated through smart-contract updates while the underlying blockchain artifacts remain available for investigation. Organizations should strengthen user awareness around fake CAPTCHA instructions, monitor suspicious Terminal and osascript activity, investigate unauthorized LaunchAgents, restrict abnormal blockchain RPC communications, and hunt for credential-theft and cryptomining behavior. Removing the persistent backdoor is particularly important because secondary payloads can be redeployed after individual malware components are removed.
THREAT PROFILE:
| Tactic | Technique Id | Technique | Sub-technique |
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Execution | T1059.002 | Command and Scripting Interpreter | AppleScript |
| T1059.004 | Unix Shell | ||
| Persistence | T1543.001 | Create or Modify System Process | Launch Agent |
| Stealth | T1140 | Deobfuscate/Decode Files or Information | — |
| T1480.001 | Execution Guardrails | Environmental Keying | |
| Defense Impairment | T1553.001 | Subvert Trust Controls | Gatekeeper Bypass |
| Credential Access | T1555.001 | Credentials from Password Stores | Keychain |
| T1555.003 | Credentials from Web Browsers | ||
| T1056.002 | Input Capture | GUI Input Capture | |
| Collection | T1005 | Data from Local System | — |
| Command and Control | T1102.002 | Web Service | Bidirectional Communication |
| T1071.001 | Application Layer Protocol | Web Protocols | |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | — |
| Impact | T1496.001 | Resource Hijacking | Compute Hijacking |
MBC MAPPING:
| Objective | Behavior ID | Behavior |
| Command and Control | B0030 | C2 Communication |
| Defense Evasion | B0029 | Polymorphic Code |
| Discovery | E1082 | System Information Discovery |
| Execution | E1204 | User Execution |
| Exfiltration | E1020 | Automated Exfiltration |
| Impact | B0022 | Remote Access |
| Persistence | F0012 | Registry Run Keys / Startup Folder |
| Cryptography Micro-objective | C0027 | Encrypt Data |
REFERENCES:
The following reports contain further technical details:
https://cybersecuritynews.com/fake-captcha-tricks-mac-users/
https://notes.netbytesec.com/2026/08/anatomy-of-macos-clickfix-crimekit-that.html