The most unsettling part is that the fake macOS update silently copies a command to the clipboard, then nudges the victim to paste it in Terminal. That’s the catch.
Key Takeaways
- North Korean‑linked actors are running a macOS malvertising campaign that uses a full‑screen fake update to deliver malware.
- The campaign employs a clipboard‑copy technique known as ClickFix to trick users into executing a curl command.
- Command‑and‑control is hidden behind an Ethereum smart contract – a method dubbed EtherHiding.
- Two payloads are delivered: a stealer that targets 157 cryptocurrency wallets and a malicious Chrome extension that drains wallets via a patched Secure Preferences file.
- Both Ethereum contracts were funded with roughly ~0.0126 ETH and then abandoned after forwarding the leftover ~0.006 ETH.
macOS Malvertising Campaign Targets Developers
AllSecure uncovered a campaign that starts when a user clicks a sponsored search result for an apparently innocuous product – in the observed case, an electrophoresis machine. The moment the page loads, the browser flips to a full‑screen macOS reboot message that pretends a system update is in progress. It’s a classic social‑engineering ploy, but the twist is that the fake UI also copies a Terminal command to the clipboard without the user noticing.
“The experience is designed to induce panic,” AllSecure said in a report shared with The Hacker News. “The computer appears frozen or rebooting, so a user who believes the OS has failed follows instructions they would otherwise find suspicious.”
That panic is the attacker’s lever. When the fake update finishes, the page tells the victim to open Terminal and paste the pre‑copied command. The command is a curl request that fetches the next‑stage malware, which then spawns a Node.js backdoor.
How the ClickFix Trick Works
Full‑screen fake update
The fake update mimics Apple’s own UI down to the icons and progress bar. Because the page runs in full‑screen mode, users can’t easily switch tabs or see the URL bar. The design is so convincing that the victim’s screen looks frozen or rebooting, reinforcing the sense that something is wrong.
Clipboard command injection
While the fake UI is displayed, JavaScript silently copies a curl command to the clipboard. The script then prompts the user to open Terminal and paste the command. Because the command is already on the clipboard, the victim doesn’t have to type anything – they just press ⌘‑V and hit return.
Attempts to reproduce the sequence on a clean machine don’t yield the same result, meaning the activation is intended to be single‑use. That single‑use nature makes detection harder, because the malicious payload only appears after the user follows the exact steps.
EtherHiding: Blockchain‑Based C2
The backdoor doesn’t contact a static domain. Instead, it queries an Ethereum smart contract to resolve the live C2 address. This technique, called EtherHiding, lets the attackers move the server address off‑chain and change it at will, making takedown attempts far less effective.Two Ethereum addresses are embedded in the malware: “rg‑telemetry[.]sbs/api” and “th‑updates[.]sbs/analytics.” Each contract was created by a throwaway wallet that followed a four‑step script: fund with ~0.0126 ETH, deploy the contract, write the config, forward the leftover ~0.006 ETH, then abandon the wallet.
- Funding pattern shows an industrialised deployment process.
- Both contracts point to the same wallet cluster, indicating a single actor.
- Using Ethereum makes the C2 infrastructure resilient to traditional domain‑seizure tactics.
Payloads: Wallet Stealer and Chrome Extension
Once the backdoor establishes contact, it checks in every five minutes and executes any JavaScript the server returns. The first payload is an information stealer that harvests data from Chrome, Brave, Edge, Firefox, Opera, and Vivaldi, plus credentials for SSH, AWS, Azure, and npm. Most alarming is its ability to scrape 157 cryptocurrency wallets.
The second payload is a malicious “Google Drive Offline” extension. The implant patches Chrome’s Secure Preferences file to sideload the extension, then uses it to siphon funds from the victim’s wallet. The extension masquerades as a legitimate offline‑drive feature, so users rarely suspect it.
Attribution and Operational Patterns
AllSecure’s analysis links the campaign to the UNC5342 group, also known as Contagious Interview, which has a history of using fake job interviews to spread malware. This time, however, the lure isn’t a job offer; it’s a generic web search. Christian Papathanasiou, co‑founder and CEO of AllSecure, said, “The delivery context is also : DPRK‑linked campaigns are often described through the lens of fake job interviews and developer recruitment, but this case shows the same operational logic appearing in a broader browsing scenario.”
That observation expands the threat model for developers. The same operational playbook that once targeted job‑seeking coders now reaches anyone who clicks a sponsored ad. It doesn’t replace the fake‑job pattern; it simply widens the attack surface.
Both the backdoor and the browser‑extension drainer are funded from the same wallet cluster, reinforcing the conclusion that a single actor is behind the entire operation.
What This Means For You
If you’re a macOS developer or a security‑focused professional, the first thing you should do is educate your team about the ClickFix technique. Because the malicious command is already on the clipboard, a quick glance at Terminal won’t reveal anything suspicious. Encourage users to verify any pasted command before executing it, and consider deploying clipboard‑monitoring tools that alert when unknown content is copied.
Second, tighten your browser’s extension policies. The malicious Chrome extension modifies the Secure Preferences file, a location most admins don’t routinely audit. Regularly review that file for unexpected entries, and use enterprise‑grade policies that block sideloaded extensions unless they come from the Chrome Web Store.
Finally, monitor your network for outbound connections to unknown Ethereum nodes. EtherHiding relies on fetching contract data from the blockchain; spotting unusual Ethereum RPC traffic can give you an early warning before the backdoor even fetches its payload.
As attackers keep moving C2 to blockchain, traditional domain‑blocking won’t cut it. You’ll need to adopt a more nuanced approach that includes blockchain traffic analysis.
Will the next wave of macOS malvertising shift from fake updates to other native UI tricks, or will attackers double down on blockchain‑based C2 to stay one step ahead of defenders?
Historical Context: Evolution of macOS Malvertising
Mac‑focused malicious campaigns have existed for several years, often using the platform’s perceived security reputation to lower user vigilance. Early variants typically used simple drive‑by downloads that prompted users to “install” a fake security update. Those attacks relied on basic social‑engineering without any clipboard manipulation.
Over time, threat actors refined the approach. They began to hijack full‑screen browser capabilities, allowing them to render a mock system dialog that covers the entire display. This technique made it harder for victims to escape the malicious page, as the usual browser chrome disappears.
The introduction of clipboard‑based command injection, branded as ClickFix, marked a notable escalation. By pre‑loading the exact curl command, attackers eliminated the typing step that often triggers suspicion. The method mirrors earlier “copy‑and‑paste” scams seen on Windows, but it is tailored to macOS’ Terminal workflow.
Parallel to UI tricks, the command‑and‑control landscape has shifted toward decentralized platforms. Prior campaigns sometimes used hard‑coded IP addresses or domain names that could be seized by law‑enforcement. The move to Ethereum smart contracts—EtherHiding—removes that single point of failure, giving adversaries a dynamic, hard‑to‑track channel.
Understanding this trajectory helps defenders anticipate future variants. The pattern suggests that attackers will continue to blend convincing UI spoofing with increasingly opaque infrastructure, pushing the boundaries of what appears “native” on a Mac.
Technical Architecture: From Click to Payload
The attack chain can be broken into four distinct stages, each with its own technical footprint.
- Initial Vector: A sponsored search result lures the victim to a malicious landing page. The page immediately requests full‑screen mode, which the browser grants after a single user interaction.
- Fake Update UI: JavaScript renders an Apple‑styled update screen. While the UI persists, a hidden script executes
navigator.clipboard.writeText()to place the curl command into the system clipboard. - Terminal Execution: The page instructs the user to open Terminal and paste the pre‑copied command. The pasted command resolves to a remote URL, typically a raw file hosted on a content‑delivery network.
- Backdoor Deployment: The downloaded script spawns a Node.js process that runs silently in the background. Upon launch, it queries an Ethereum node for the smart‑contract address, retrieves the C2 endpoint, and begins polling every five minutes for new instructions.
Once the backdoor is live, the server can push any JavaScript payload. The first payload focuses on credential harvesting, scanning browsers and cloud‑service configuration files for reusable secrets. The second payload targets Chrome’s Secure Preferences, inserting a malicious extension that masquerades as a legitimate offline‑drive feature.
This modular architecture makes it easy for the operators to swap out components without redeploying the entire chain. For defenders, each stage offers a potential detection point: full‑screen requests, unexpected clipboard writes, anomalous curl executions, and periodic Ethereum RPC calls.
Expanded Scenarios: Concrete Steps for Developers and Teams
Scenario 1 – A solo developer testing a new macOS build. The developer often runs Terminal commands directly from copied snippets. If a clipboard‑monitoring utility flags an unexpected curl line, the developer can pause, verify the source URL, and avoid executing the payload. Adding a quick “inspect clipboard” habit reduces risk dramatically.
Scenario 2 – A small startup with a shared CI/CD environment. Build agents pull code from repositories and occasionally run scripts that include curl calls for dependency fetching. By whitelisting only known repository domains and rejecting any curl target that resolves to an Ethereum node, the pipeline gains a layer of protection without impacting legitimate workflows.
Scenario 3 – Remote employees using corporate‑issued Macs. IT can enforce a policy that disables full‑screen permission for browsers unless the site is explicitly trusted. Coupled with a rule that blocks outbound traffic to non‑standard Ethereum RPC ports, the organization can stop the attack before it reaches the backdoor stage.
Each scenario emphasizes a different control point, yet all share the same principle: validate what’s copied, where it’s sent, and who can request blockchain data. Simple procedural changes can disrupt an entire campaign.
Key Questions Remaining
- Will future macOS malvertising campaigns adopt other native UI elements—such as system preference panes—to further blur the line between legitimate and malicious screens?
- How will defenders adapt to the growing use of blockchain as a C2 medium, especially when smart‑contract interactions are encrypted and hard to attribute?
- Can security vendors develop a reliable signature for the ClickFix clipboard injection technique without generating false positives across benign developer workflows?
Answers to these questions will shape the next generation of defensive tooling. In the meantime, vigilance, layered controls, and a culture of verification remain the most effective safeguards.
Sources: The Hacker News, SecurityWeek
