This campaign targets Windows and macOS users via social engineering through fake CAPTCHA pages that lead victims to execute malicious commands. On macOS, the malware uses AppleScript to steal extensive sensitive information, including keychain data, credentials, session cookies from 12 browsers, over 200 browser extensions, and 16 cryptocurrency wallets. It enforces persistence and user interaction by displaying a non-closable dialog box that mimics legitimate system prompts to obtain the victim's system password. The stolen session cookies facilitate session hijacking, enabling attackers to bypass multi-factor authentication protections. The campaign uses client-side JavaScript to identify desktop users and deliver OS-specific payloads, ignoring mobile devices. Apple has introduced native terminal security warnings in recent macOS versions to help users recognize and avoid pasting malicious commands.

The campaign enables attackers to harvest highly sensitive data including credentials, keychain contents, browser session cookies, and cryptocurrency wallet information. This can lead to unauthorized access to user accounts, bypassing multi-factor authentication through session hijacking, and theft of cryptocurrency assets. The persistent dialog box coercion increases the likelihood of privilege escalation by obtaining system passwords. The campaign's social engineering approach increases the risk of successful infection among targeted users. However, there are no known exploits in the wild reported at this time.

There is no specific patch available for this campaign as it relies on social engineering and user interaction. However, recent macOS updates include native terminal security warnings that alert users when pasting potentially malicious commands, which helps mitigate risk. Users should be cautious about executing commands from untrusted sources and avoid interacting with suspicious CAPTCHA pages or dialogs. Security awareness training to recognize social engineering tactics is recommended. Monitor for indicators of compromise such as the listed domains, IP addresses, and hashes. Since this is not a software vulnerability, remediation focuses on user education and leveraging built-in macOS protections.