New Clickfix Variant ‘Matryoshka’ Attacking Users to Deploy macOS Stealer Malware
A newly identified social engineering campaign is targeting macOS users through a sophisticated malware deployment known as "Matryoshka." This threat employs an advanced version of the ClickFix technique to distribute stealer malware.
A newly identified social engineering campaign is targeting macOS users through a sophisticated malware deployment known as "Matryoshka." This threat employs an advanced version of the ClickFix technique to distribute stealer malware.
The Matryoshka variant utilizes multiple layers of obfuscation to conceal malicious code, making it difficult for security scanners and automated systems to detect. The attack deceives users into executing Terminal commands that appear to be legitimate software fixes, circumventing conventional security measures.
This operation exploits typosquatting domains to misdirect users who incorrectly type legitimate website addresses, particularly those seeking software review sites. Once redirected, users encounter a deceptive installation prompt instructing them to execute a "fix" command in the macOS Terminal application.
Unlike previous ClickFix variants, Matryoshka employs sophisticated evasion strategies, complicating detection. The payload remains encoded and compressed until execution, activating only in memory to avoid creating detectable file artifacts. This significantly reduces visibility for file-based security scanning systems.
The attack deceives users into executing Terminal commands that appear to be legitimate software fixes, circumventing conventional security measures.
Upon execution, the loader retrieves an AppleScript payload aimed at extracting browser credentials and targeting cryptocurrency wallet applications, including Trezor Suite and Ledger Live. The malware attempts to steal credentials programmatically before resorting to fake system dialogs requesting passwords.
Infection Mechanism and Evasion Tactics
The Matryoshka infection chain includes multiple stages designed to evade detection. The malicious Terminal command retrieves a shell script containing a large encoded payload. This payload is decoded and decompressed in memory, avoiding the creation of detectable files.
Evasion techniques include detaching the main routine to the background and quickly exiting, making the Terminal prompt return immediately, leading users to believe the process is complete. Additionally, the script suppresses visible artifacts in the terminal session, and the command-and-control infrastructure uses custom headers to avoid automated scanning.
Users are advised to avoid pasting commands from websites into Terminal, as legitimate software updates do not require this action. Organizations should block typosquatting domains, monitor Terminal-initiated execution patterns, and watch for suspicious activities related to staging archives or wallet application tampering.
Based on reporting by Cyber Security News.