A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)
Source SANS ISC Handlers Diary
Description
Introduction
Impact
The malware steals sensitive information from infected macOS hosts, including files, application data, and credentials stored in the macOS Keychain. It achieves persistence on the system and maintains ongoing communication with a C2 server to exfiltrate data. The campaign's use of social engineering (fake CAPTCHA pages and clipboard injection) increases the likelihood of user infection. There is no indication of ransomware or destructive payloads, but the information theft poses a significant privacy and security risk to affected users.
Defensive guidance
Mitigation should focus on user awareness to avoid executing suspicious scripts or commands, especially those received via clipboard injection or from untrusted domains. Monitoring for persistence mechanisms such as suspicious LaunchAgents plist files and unexpected binaries in user Library/Caches directories can aid detection. Blocking known malicious domains and IP addresses associated with the campaign can reduce exposure. Since the malware requests extensive permissions, users should be cautious about granting access prompts. No vendor advisory or official remediation guidance is available; therefore, users should follow best practices for macOS security and incident response.
Summary
This malware campaign targets macOS systems by delivering an information stealer distinct from AMOS Stealer, using architecture-specific Mach-O binaries. The infection begins with a shell script loader downloaded from a malicious server, which saves a binary to the user's Library/Caches directory and ensures persistence via a LaunchAgents plist file. The malware requests permissions to access various user files, applications, and credentials, including the macOS Keychain. Post-infection, the malware communicates with a C2 server using HTTP POST requests and websocket traffic to exfiltrate stolen data. The binaries on disk show slight variations in size and hash, indicating multiple copies or versions. The campaign uses fake CAPTCHA/verification pages and clipboard-injected text to trick users into executing the loader.
References
Community reviews
Related threats
- Bring a tent, I've got the coffee: Lessons from it-saMalware
- ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationHighVulnerability
- Want to Rent an Internet Address at the White House?News
- Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into ProxiesBotnet
- Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware