ClickFix Campaign Uses Fake macOS Prompts to Deploy an AppleScript Stealer

Jul 22, 2025 · Original article ↗

Summary

Researchers analyzed a macOS ClickFix campaign that uses fake verification pages to make users run terminal commands, then steals browser data, crypto-wallet files and documents with an AppleScript payload.

Key points

Fake verification pages instruct users to open Terminal and run copied, base64-encoded shell commands; the campaign avoids a conventional malware download.
The commands fetch and run a script that deploys an AppleScript stealer on macOS.
The payload targets browser cookies, saved logins, profile data, crypto-wallet files, Safari cookies, Keychain files, Apple Notes databases, and selected Desktop and Documents files.
Collected data is packaged as a ZIP archive and uploaded to an attacker-controlled server; the script then deletes its temporary files.
The analysis identified phishing domains and command-and-control infrastructure, including servers using SSH, HTTP, and less common ports such as 3333.
Hunt.io queries found more than 50 servers with infrastructure or header patterns associated with the investigation.
Recommended defenses include blocking known indicators, monitoring suspicious shell and AppleScript activity, and warning users not to run commands supplied by webpages.

Article Details

Attack Vectors: Fake phishing pages imitate security checks or CAPTCHAs and instruct macOS users to copy and run terminal commands, including base64-decoded shell commands.
The commands download and execute an AppleScript stealer that collects browser credentials, cookies, crypto-wallet data, and selected user files.
The stealer packages collected data into a ZIP archive and uploads it to attacker-controlled infrastructure over HTTP.
The script deletes its temporary working directory and ZIP archive after execution.
Defensive Notes: Block the identified malicious domains and IP addresses at the network level.
Detect suspicious command-line patterns such as `base64 -d | bash` and monitor AppleScript and shell activity on macOS.
Warn users about fake CAPTCHA or verification pages that ask them to run copied terminal commands.
Monitor unusual outbound connections, including connections to suspicious IP addresses and uncommon ports such as 3333 and 5201.
Review CORS settings; avoid wildcard origins and allowing cookies in cross-origin requests.
Use network segmentation and apply detection rules for the reported infrastructure patterns.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`appmacosx[.]com`	Listed as fake macOS app-store delivery and phishing infrastructure.
DOMAIN	`apposx[.]com`	Listed as a variant of a fake macOS app-store phishing domain.
DOMAIN	`appxmacos[.]com`	Listed as fake macOS app-store delivery and phishing infrastructure.
DOMAIN	`cryptoinfnews[.]com`	Listed as a misspelled clone used for crypto-themed phishing.
DOMAIN	`cryptoinfo-allnews[.]com`	Listed as a crypto-themed phishing and typosquatting domain.
DOMAIN	`cryptoinfo-news[.]com`	Identified as a fake crypto-news phishing site used to prompt users to run malicious commands.
DOMAIN	`dactarhome[.]com`	Listed as possibly phishing in the article's IOC table.
DOMAIN	`emailreddit[.]com`	Listed as phishing infrastructure impersonating Reddit.
DOMAIN	`financementure[.]com`	Listed as a fake financial-service phishing domain.
DOMAIN	`greenpropertycert[.]com`	Listed as a fake real-estate certification phishing domain.
DOMAIN	`macosx-app[.]com`	Listed as a fake macOS store phishing domain.
DOMAIN	`macosx-apps[.]com`	Listed as a fake macOS store phishing domain.
DOMAIN	`macosxappstore[.]com`	Listed as phishing infrastructure impersonating the Mac App Store.
DOMAIN	`macxapp[.]com`	Listed as phishing infrastructure mimicking legitimate macOS apps.
DOMAIN	`odyssey-st[.]com`	Listed in the article's IOC table as stealer C2 infrastructure.
DOMAIN	`odyssey1[.]to`	Identified as stealer C2 and as a source of a script downloaded by the phishing command.
DOMAIN	`ttxttx[.]com`	Listed as a phishing domain, likely used to evade detection.
HOSTNAME	`www[.]cryptoinfo-news[.]com`	Listed as a duplicate hostname for the fake crypto-news phishing site.
IPV4	`185[.]147[.]124[.]212`	Listed as an IP address associated with the campaign's C2 infrastructure.
IPV4	`185[.]39[.]206[.]183`	Listed as an IP address associated with the campaign's C2 infrastructure.
IPV4	`188[.]92[.]28[.]186`	Listed as an IP address associated with the campaign's C2 infrastructure.
IPV4	`194[.]26[.]29[.]217`	Identified among servers returned by the infrastructure hunt and listed as campaign-related infrastructure.
IPV4	`45[.]135[.]232[.]33`	Identified as a C2 server and payload host; the stealer uploads the ZIP archive to this address.
IPV4	`45[.]146[.]130[.]129`	Listed as an IP address associated with the campaign's C2 infrastructure.
IPV4	`45[.]146[.]130[.]131`	Identified among servers returned by the hunt for suspicious C2 infrastructure patterns.
IPV4	`5[.]199[.]166[.]102`	Listed as an IP address associated with the campaign's C2 infrastructure.
IPV4	`83[.]222[.]190[.]214`	Identified as the IP address resolving for a phishing domain and scanned as a main C2 server.
IPV4	`88[.]214[.]50[.]3`	Listed as an IP address associated with the campaign's C2 infrastructure.
URL	`hxxp[:]//45[.]135[.]232[.]33/log`	Specific HTTP endpoint used by the stealer to upload the collected-data archive.