This sophisticated macOS campaign exploits ClickFix social engineering to deceive victims into executing malicious AppleScript commands via fake CAPTCHA verification pages. The attack chain installs a persistent backdoor agent that uses EtherHiding, storing C2 addresses within Polygon blockchain smart contracts, which makes infrastructure detection challenging. Persistence is achieved through LaunchAgents, and the malware deploys multiple payloads including the AMOS stealer, which targets cryptocurrency wallets, browser credentials, and macOS Keychain data, alongside the XMRig cryptominer for sustained revenue generation. The operation demonstrates advanced evasion techniques such as character-ID obfuscation, blockchain-based infrastructure, and abuse of legitimate macOS utilities. Analysis of blockchain transactions reveals the complete C2 rotation history and funding trails, offering defenders infrastructure-level pivots despite the campaign's memory-resident execution model.

The campaign compromises macOS systems by installing a persistent backdoor that steals sensitive information including cryptocurrency wallets, browser credentials, and Keychain data. It also runs a cryptominer (XMRig) that consumes system resources for illicit revenue generation. The use of blockchain-based C2 infrastructure complicates detection and takedown efforts, increasing the difficulty of defensive measures. The malware's persistence and evasion techniques increase the likelihood of prolonged unauthorized access and data exfiltration.

No official patch or vendor advisory is available for this malware campaign. Defenders should focus on user education to prevent social engineering attacks, monitor for suspicious AppleScript execution, and investigate persistence mechanisms such as LaunchAgents on macOS systems. Blockchain analysis can provide indicators of compromise related to C2 infrastructure. Since the malware abuses legitimate macOS utilities, behavioral detection and endpoint monitoring are recommended. Patch status is not yet confirmed — check vendor advisories for any updates.