Affected Systems
macOS devices. No specific version restrictions identified. Targets Keychain, browser data, credentials, SSH keys, and sensitive user files. Delivered via ClickFix social engineering (malicious Terminal commands).
Exploitation Status
Active campaign confirmed. Microsoft Defender Experts observed live data exfiltration, not just beaconing. Threat actor rapidly rotates C2 domains after public disclosure. Over 30 related domains identified through behavioral correlation.
Business Impact
MacOS endpoints face credential theft and data exfiltration risk. Threat actor uses ClickFix social engineering to trick users into running malicious curl commands in Terminal. Stolen data includes Keychain material, browser credentials, cloud/SSH keys, and files from user directories. Domain rotation undermines static IOC blocking, but behavioral patterns (URI paths, curl command-line arguments, HTTP PUT upload parameters) provide durable detection opportunities. No CVE assigned; this is a malware campaign, not a vulnerability.
Urgency
🟠Within 24 hours
Recommended Actions
- Monitor macOS endpoints for curl commands with suspicious arguments: -k, -s, --max-time, --data-binary, especially from interactive shell sessions or user-initiated Terminal activity
- Hunt for HTTP PUT requests with parameters upload_id, chunk_index, and total_chunks in proxy/firewall logs; correlate with curl process telemetry
- Block or alert on recurring URI patterns: /curl/, /dynamic?txd=, /gate?buildtxd= in outbound HTTP/HTTPS traffic from macOS devices
- Implement behavioral detection for file staging under temporary paths followed by compression and chunked uploads via curl
- Educate macOS users on ClickFix social engineering: never paste or run Terminal commands from untrusted sources, emails, or websites