Kiran 
A newly documented macOS attack chain shows just how far social engineering has evolved, tricking Mac users into pasting a single terminal command that unleashes a backdoor, an info-stealer, and a cryptominer, all coordinated through a command server hidden inside a Polygon smart contract.
Researchers Amin Hazim and Badrul Munir detailed the campaign in a technical teardown published on their Netbytesec blog.
macOS ClickFix Malware Hides C2 on Polygon Blockchain
The infection starts on a Cloudflare Pages site impersonating a “TrustKey” human-verification gateway. Victims see an ordinary “I’m not a robot” checkbox; clicking it silently copies a malicious command to the clipboard while displaying instructions to open Terminal and paste it.
This is the ClickFix technique: instead of tricking users into downloading a file, attackers get victims to execute code themselves, bypassing macOS Gatekeeper entirely since no file is ever written to disk at the point of execution.
The pasted command is a base64-encoded curl request to a Cloudflare Worker, which returns a osascript command macOS’s built-in AppleScript interpreter. From there, several layers of obfuscated AppleScript establish persistence via a LaunchAgent and drop a loader that uses character-by-character string construction to dodge static detection tools.
The loader’s real innovation is how it finds its command-and-control server. Rather than hardcoding a domain, it queries a Polygon smart contract using a read-only eth_call, extracts a hexadecimal string, and decodes it into a live C2 hostname.
Because the read generates no transaction and costs no gas, there’s no on-chain footprint from the malware’s side and no domain baked into the sample for defenders to block in advance.
But that same design cuts both ways. Because every C2 rotation the operator makes is a transaction, and blockchain transactions are permanent and public, researchers reconstructed the entire campaign timeline 21 C2 domain rotations dating back to May 2026 simply by decoding the contract’s historical calldata.
They even traced the operator’s initial funding: 30 POL forwarded through a relay wallet from what appears to be an exchange or OTC hot wallet.
The first payload dropped, dubbed bmodule, isn’t malware in the traditional sense; it’s a persistent agent that fingerprints the host, phishes the macOS login password through a fake “System Preferences” dialog, resets TCC privacy permissions, and polls the C2 every 60 seconds for tasking. Depending on the operator’s command, it can deploy:
- smodule – a full build of the Atomic macOS Stealer (AMOS), targeting 22 desktop crypto wallets, 193 browser-extension wallet IDs, keychain data, and Telegram sessions.
- lmodule – a lighter, faster AMOS variant that skips file grabbing for stealth.
- ledger + xmr – an unmodified XMRig miner pulling Monero for the attacker’s wallet, camouflaged behind TLS traffic on port 443.
Stolen data is zipped with the legitimate ditto utility and routed by file size to either a bare-IP dropzone or a secondary domain, closing out a chain that spans social engineering, blockchain abuse, credential theft, and monetized CPU hijacking.
The researchers stress that removing the miner or stealer alone accomplishes little; the persistent LaunchAgent will simply redeploy them.
The more durable defensive lead is the operator’s Polygon wallet itself: since it must publish every new C2 address on-chain to keep the operation running, monitoring that wallet gives defenders a rare, rotation-proof indicator in an otherwise fast-moving infrastructure.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
