Infostealers Hit macOS via ClickFix

🔑 Enhanced Key Takeaways

• •ClickFix uses Base64-encoded shell commands copied to clipboard from fake CAPTCHA or security pages, executing Odyssey or AMOS infostealers via AppleScript that targets crypto wallets, browser data, and keychains[1][3][5].
• •Variants like Matryoshka employ nested obfuscation, in-memory compressed wrappers, and API-gated C2 communications to evade analysis and sandboxes[2].
• •Recent evolutions include multistage loaders patching legitimate apps like Electron ASAR files with seed phrase exfiltration and ad-hoc re-signing to bypass verification[4].

🛠️ Technical Deep Dive

• •Malicious command sequence: retrieves username with whoami, prompts and validates password via dscl . -authonly, stores in /tmp/.pass, downloads payload with curl, removes quarantine using sudo -S xattr -c, chmod +x, and executes[5].
• •Odyssey creates out.zip or /tmp/osalogging.zip archiving stolen data (keychains, cookies, Notes, wallets) for silent C2 exfiltration, running via legitimate processes like bash[1][2].
• •MacSync variant uses shell loaders, dynamic AppleScript, in-memory execution, API key authentication with curl (disguised user agent), and patches app.asar/Info.plist before ad-hoc signing[4].
• •Matryoshka involves typosquatted domains (e.g., comparisions[.]org), Traffic Distribution System redirects, and final fake error messages to misdirect victims[2].

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline