Mac Users Tricked

Overview

Mac users are being targeted by a ClickFix campaign that disguises itself as a routine CAPTCHA check. Instead of downloading an app, victims are tricked into pasting a malicious command into Terminal, bypassing Gatekeeper protections and opening the door to password theft, remote control, and cryptocurrency mining.

Infection Chain

• Fake TrustKey CAPTCHA: Displays an “I’m not a robot” box that silently copies a command.
• Terminal execution: Victims are instructed to paste the command into Terminal.
• Cloudflare Worker payload: The command fetches encoded AppleScript, which installs a LaunchAgent for persistence.
• EtherHiding technique: Queries a Polygon smart contract to dynamically locate its command server, complicating tracking.
• Backdoor deployment: Identifies device/user, checks in with the server, and requests new tasks every minute.

Malicious Capabilities

• Password theft: Presents a counterfeit macOS System Preferences prompt to capture login credentials.
• AMOS stealer module: Extracts browser passwords, cookies, wallet extensions, Telegram data, Apple Notes, and Keychain secrets.
• Cryptomining: Deploys XMRig to mine Monero, causing CPU overload, heat, and battery drain.
• Persistence: LaunchAgent ensures malware restarts at login.
• Fake update overlays: Hide malicious activity behind counterfeit update screens.

Indicators of Compromise (IoCs)

• URLs: trustkey-otcheckv1[.]pages.dev, adrianroy-01[.]workers.dev, 67sixcebeh[.]surf/upload.php
• Domains: hf98x4d[.]site, sj98xe4[.]xyz, 67sixcebeh[.]surf
• IPs: 162.159.36.12, 104.21.4.95, 62.60.226.0
• Blockchain contract: 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0
• Malware hashes: 9a6b91a3cc2867d4d493823f425f1397afac0f52e17acae937560c3f4d73080d (Worker payload), 4542d94e24b6829e262b1c4af8467e11e40f078ce135d0b110054db4b9577cf0 (AMOS module).

Defensive Guidance

• Avoid Terminal instructions: No legitimate CAPTCHA requires command execution.
• Inspect LaunchAgents: Look for unexpected agents in /Library/LaunchAgents/.
• Monitor Polygon RPC requests: Detect EtherHiding infrastructure queries.
• Check for fake prompts: Be wary of repeated Keychain access requests.
• Incident response: Disconnect compromised Macs, rotate credentials, and conduct forensic analysis.

Expert in the Cloud Insight

This campaign shows how attackers are weaponizing trust cues like CAPTCHAs to bypass user suspicion. By combining blockchain‑based infrastructure (EtherHiding) with persistent backdoors and cryptomining, the attackers ensure both stealth and profit. The lesson is clear: Mac users are not immune to malware, and vigilance against unusual verification steps is essential.