Anatomy of a macOS ClickFix Crimekit that Weaponises EtherHiding

A sophisticated macOS malware campaign exploits social engineering via ClickFix fake CAPTCHA verification pages to execute malicious AppleScript commands. The attack chain installs a persistent backdoor agent that uses EtherHiding by embedding C2 addresses within Polygon blockchain smart contracts, making infrastructure detection difficult. Persistence is achieved through LaunchAgents. Payloads include the AMOS stealer, which exfiltrates cryptocurrency wallets, browser credentials, and macOS Keychain data, and the XMRig cryptominer for sustained illicit mining. The operation features advanced evasion techniques such as character-ID obfuscation and misuse of legitimate macOS utilities. Analysis of blockchain transactions provides defenders with insights into C2 rotation and funding despite the malware's memory-resident execution model.

The malware compromises sensitive user data including cryptocurrency wallets, browser credentials, and macOS Keychain secrets. It also enables unauthorized cryptocurrency mining, potentially degrading system performance and increasing power consumption. The use of blockchain-based C2 infrastructure complicates detection and takedown efforts, increasing the persistence and stealth of the campaign.

No official patch or remediation is indicated. Defenders should focus on user awareness to prevent social engineering attacks involving fake CAPTCHA pages and malicious AppleScript execution. Monitoring for suspicious LaunchAgents and unusual AppleScript activity on macOS systems may help detect infections. Analysis of blockchain transactions related to the campaign can provide intelligence for infrastructure disruption. Since this is a malware campaign rather than a software vulnerability, standard patching does not apply.