Top Highlights
- The Macfinder ClickFix malware exfiltrates data via websocket traffic and HTTP POST requests to designated C2 URLs, enabling stealthy data theft.
- It employs a multi-architecture Mach-O binary loader, downloaded from remote servers, with persistent persistence through launch agents and varied binary copies.
- The malware requests extensive permissions, including access to folders, applications, and keychain passwords, facilitating comprehensive system control and credential capture.
Threat, Attack Techniques, and Targets
The Macfinger ClickFix campaign delivers malware that acts as an information stealer. The malware uses a different method from the AMOS Stealer variant. It exfiltrates data through WebSocket traffic along with HTTP POST requests. The malware is hosted on a domain called hollow-badger-moasfraum[.]life and download URLs from IP addresses like 45.131.215[.]56. They use a shell script loader that saves a binary to system folders. The binary depends on the system’s architecture, using either arm64 or x86_64 Mach-O binaries. The malware infects macOS systems, targeting files and application data. It also asks for various permissions, including access to folders and passwords. These techniques show a focus on stealth and persistence. The targets are macOS devices, especially systems with ARM-based or Intel processors.
Impact, Security Implications, and Remediation Guidance
This malware can cause serious harm by stealing sensitive information and maintaining persistence on infected systems. The exfiltration of credentials and files poses a significant risk. It also manipulates system processes and requests access to private data, increasing the threat level. The malware uses techniques like hiding in system folders and altering launch agents, making it harder to detect and remove. Given the complexity and variability of the malware, organizations should seek removal and mitigation guidance from the relevant vendor or cybersecurity authority. Ensuring systems are up to date and monitoring for suspicious network traffic, especially WebSocket and unusual POST requests, are important preventive steps.
Continue Your Tech Journey
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
