Matryoshka Clickfix Variant Targets macOS Users, Deploys New Stealer Malware
## Cybersecurity: Matryoshka Social Engineering Campaign Targeting macOS
Cybersecurity: Matryoshka Social Engineering Campaign Targeting macOS
A new iteration of the ClickFix social engineering campaign is specifically targeting macOS users. Named "Matryoshka," this variant introduces multiple nested obfuscation layers, enhancing its evasion capabilities, including in-memory decompression and API-gated communication, which complicate detection and analysis.
The attack sequence initiates when a user visits a deceptive domain such as comparisions[.]org, a misspelled version of the legitimate comparisons.org site. This domain is part of a Traffic Distribution System (TDS) that redirects victims to spoofed support pages or fake update portals.
When triggered, the sequence loads a stealthy AppleScript payload aimed at stealing browser credentials and compromising cryptocurrency wallet applications. The attack exploits typosquatting domains and redirect infrastructures to deceive users into executing a "Terminal fix command."
The command downloads a small script, known as rogue.sh, from domains like barbermoo[.]xyz. This script contains a Base64-encoded and gzip-compressed payload that unpacks in memory using a sequence of Base64 decode → gunzip → eval. This structure ensures the inner payload remains hidden from traditional file-based scanners.
If validated, the C2 server delivers a malicious AppleScript payload (rogue_applescript.scpt), identified by Intego as trojan:AppleScript/Stealer.gen. The inner loader employs various anti-analysis techniques for stealth:
Background detachment: The loader runs in the background to avoid suspicion. Output suppression: Hides script activity and errors. API-gated communication: Requires a secret header for server responses, hindering traffic emulation. Argument-based forwarding: Transmits harvested data between stages by appending command-line arguments to outbound requests.
Matryoshka avoids writing key components to disk, evading static inspection and many sandbox environments. It primarily seeks to extract stored passwords and cryptocurrency wallet credentials. When direct theft fails, it triggers a phishing loop to capture credentials by mimicking a macOS "System Preferences" password dialog.
It targets Ledger Live and Trezor Suite applications through stealth persistence techniques. After data collection, the malware packages stolen information into /tmp/osalogging.zip for upload, misleading users with a deceptive system message.
A new iteration of the ClickFix social engineering campaign is specifically targeting macOS users.
Intego VirusBarrier detects the infection chain as follows:
trojan:OSX/Stealer.sh (Zsh/Bash loader). trojan:AppleScript/Stealer.gen (AppleScript payload).
Users are advised never to paste code into Terminal as instructed by any web content. Genuine macOS updates and fixes do not require manual command-line input. Any site requesting this action should be immediately closed.
Type Indicator Context / Description
C2 Domain barbermoo[.]xyz – Primary command-and-control (C2) infrastructure
Typosquatting Domain comparisions[.]org – Used as initial redirect (typosquat)
Gateway URL macfilesendstream[.]com/r2/ – Traffic distribution and routing point
Header api-key: 5190ef17… – Required for C2 communication (value truncated)
File Path /tmp/osalogging.zip – Staging file for stolen or exfiltrated data
SHA-256 (Observed Sample) 62ca9538 889b767b 1c3b93e7 6a32fb44 69a2486c b3ccb5fb 5fa8beb2 dd0c2b90
SHA-256 (Wrapper Script – rogue.sh) d675bff1 b895b1a2 31c86ace 9d7a39d5 704e84c4 bc015525 b2a9c80c 39158338
SHA-256 (Inner Loader Script) 48770b64 93f2b9b9 e1d9bdbf 482ed981 e709bd03 e53885ff 992121af 16f76a09
SHA-256 (AppleScript Payload – rogue_applescript.scpt) (Add if available)
Based on reporting by GBHackers.