Full Report
Data from browsers, cryptocurrency wallets, 200+ extensions hoovered up A ClickFix campaign targeting macOS users delivers an AppleScript-based infostealer that collects credentials and live session cookies from 14 browsers, 16 cryptocurrency wallets, and more than 200 extensions.…
Analysis Summary
# Tool/Technique: ClickFix (macOS AppleScript Stealer)
## Overview
ClickFix is a high-impact social engineering technique that tricks users into executing malicious commands by mimicking legitimate system prompts or CAPTCHA verifications. In this specific campaign, the technique delivers an AppleScript-based infostealer designed to exfiltrate credentials, browser data, and cryptocurrency information from macOS environments.
## Technical Details
- **Type:** Malware (Infostealer / AppleScript-based)
- **Platform:** macOS (with a Windows variant noted in the same campaign)
- **Capabilities:** Credential harvesting, session cookie theft, cryptocurrency wallet exfiltration, Keychain access, and real-time password validation.
- **First Seen:** Approximately March 2026 (Initial reporting by Netskope).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link (Fake CAPTCHA pages)
- **TA0002 - Execution**
- T1059.002 - Command and Scripting Interpreter: AppleScript
- T1204.002 - User Execution: Malicious File (Pasting curl commands)
- **TA0005 - Defense Evasion**
- T1564.004 - Hide Artifacts: Temporary Directories (/tmp/xdivcmp/)
- **TA0006 - Credential Access**
- T1141 - Input Capture (Fake system dialogs)
- T1555.001 - Credentials from Password Stores: Keychain
- T1539 - Steal Web Session Cookie
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- **Social Engineering Execution:** Users are tricked into pasting a `curl` command into Spotlight or Terminal under the guise of an "anti-bot" verification code.
- **Browser Harvesting:** Targets 12 Chromium-based browsers (Chrome, Brave, Edge, etc.) and Firefox/Waterfox to steal cookies, autofill data, and saved passwords.
- **Extension Theft:** Scans and exfiltrates data from over 200+ browser extensions, specifically targeting 2FA apps (Authy, Google Authenticator) and Password Managers (LastPass, 1Password).
- **Cryptocurrency Exfiltration:** Targets 16 standalone wallet applications (Exodus, Ledger Live, Trezor, etc.) and dozens of wallet extensions (MetaMask, Phantom).
### Advanced Features
- **Real-time Password Validation:** The malware uses macOS directory services to verify the victim's entered password. If incorrect, the dialog loop persists until a valid password is provided.
- **UI Impersonation:** Displays a "system lock" icon from local resources to perfectly mimic an authentic macOS system authentication prompt.
- **Persistent Dialogs:** the credential-harvesting prompt lacks a "Close" or "Cancel" button, effectively locking the UI until data is yielded.
## Indicators of Compromise
- **File Names:** `xdivcmp` (Stage directory in `/tmp/`)
- **Network Indicators:**
- C2 Domain: [Attacker-controlled server hosting malicious AppleScripts - see Netskope GitHub for specific domains]
- Defanged: `hxxps[://]netskope[.]com/blog/macos-clickfix-campaign` (Reference)
- **Behavioral Indicators:**
- Execution of `curl` commands directly from Spotlight or Terminal via user paste.
- Unexpected authentication prompts featuring only one action button.
- Creation of a temporary directory at `/tmp/xdivcmp/`.
## Associated Threat Actors
- **Unknown:** While the specific group is not named, the campaign is noted for targeting the Asian finance sector.
## Detection Methods
- **Behavioral Detection:** Monitor for Terminal or Spotlight launching `curl` commands that pipe directly into interpreters (e.g., `curl ... | sh` or AppleScript execution).
- **Process Monitoring:** Detect unauthorized attempts to access `/Library/Keychains/` or browser cookie databases by unsigned scripts.
- **OS-Level Protection:** Use macOS Sequoia (or later) which features native "Command Paste" alerts in the Terminal.
## Mitigation Strategies
- **User Education:** Train employees to never copy-paste "verification codes" into Terminal or Spotlight.
- **OS Updates:** Upgrade to macOS Sequoia (v26.4 or higher) to benefit from built-in paste protections.
- **Endpoint Protection:** Deploy EDR solutions capable of monitoring AppleScript execution and suspicious file access in `/tmp/`.
- **System Hardening:** Restrict execution of unsigned scripts and enforce the use of Managed Apple IDs to control permissions.
## Related Tools/Techniques
- **ClearFake:** Uses similar fake browser update/CAPTCHA overlays.
- **Amos (Atomic Stealer):** A common macOS infostealer that also targets crypto wallets and Keychains.
- **ClickFix (Windows):** The parallel version of this campaign targeting Windows via PowerShell.