---
type: reference
title: "ClickFix APT — Handoff"
description: "Threat intelligence study overview: 4-stage attack chain, IOCs, disclosure timeline, adversary infrastructure status."
tags: [security, clickfix, apt, threat-intelligence, forensics, macos, infostealer, blockchain-c2]
timestamp: "2026-07-14"
---

# ClickFix APT — Handoff

> **Status (2026-07-04):** INFECTION CHAIN FULLY SEVERED. Entry domain re-purposed, phishing page removed, payload blocked by Cloudflare (403), original C2 suspended, new C2 orphaned. Infrastructure dismantled in 9 days.

## TL;DR

A link in the official `redhat-developer/lsp4ij` README — `idetools.dev` — redirected to an active malware campaign. The expired domain was hijacked by attackers running a 4-stage macOS infostealer backed by a Polygon blockchain-based C2 resolver (BDDR). The attack was contained in 160 seconds with AI assistance. The attacker adapted by registering a new C2 domain 2 days after takedown, confirming the BDDR technique works in practice.

## Attack Flow

```
Victim clicks idetools.dev link (lsp4ij README)
    → 302 → sessionaquirecheck.pages.dev (ClickFix CAPTCHA)
    → clipboard injection (base64 payload)
    → curl | bash downloads script.sh
    → LaunchAgent persistence + fake PAM password dialog
    → bmodule polls Polygon smart contract → resolves C2 domain
    → C2 dispatches: smodule/lmodule stealer, ledger stub, reverse shell
```

Detailed pages:
- [[clickfix-attack-chain]] — Domain hijack, ClickFix, persistence, fake PAM
- [[clickfix-bddr]] — Blockchain Dead-Drop Resolver
- [[clickfix-c2-bot]] — C2 bot architecture, command dispatch
- [[clickfix-stealers]] — Infostealer modules (60 wallet targets)
- [[clickfix-iocs]] — IOC inventory, MITRE ATT&CK, detection, remediation
- [[clickfix-incident-response]] — 160-second containment, AI-assisted IR
- [[clickfix-infrastructure]] — Temporal analysis, 40-day window, monitoring

## IOC Summary

### Network

| Type | Indicator | Role | Status |
|------|-----------|------|--------|
| Domain | `idetools.dev` | Hijacked blog link | Rotated → survey-smiles.com |
| Domain | `sessionaquirecheck.pages.dev` | ClickFix phishing host | NXDOMAIN |
| Domain | `maccf9c.jetbet4.online` | Stage 1 payload server | Cloudflare 403 |
| Domain | `sj98xe4.xyz` | Original C2 | Suspended (clientHold) |
| Domain | `apdhlhs3.xyz` | New C2 (post-takedown) | Was active |
| Domain | `j9af4sr.guru` | Third C2 rotation | Latest observed |
| IP | `62.60.226.50` | Hardcoded fallback C2 | Orphaned |

### Blockchain

| Type | Indicator |
|------|-----------|
| Contract | `0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0` (Polygon) |
| Selector | `0x2686ecea` |
| Network | Polygon Mainnet |

### Host-Based (macOS)

| Path | Description |
|------|-------------|
| `~/Library/LaunchAgents/com.<random16>.plist` | Persistence daemon |
| `~/Library/<random16>` | Main malware script |
| `~/.txid` | Victim tracking ID |
| `~/.passphrase` | Stolen password (plaintext) |

## What Was Stolen vs. Blocked

| Data | Status |
|------|--------|
| macOS Admin Password | EXFILTRATED — rotated within 13 minutes |
| Keychain Passwords | BLOCKED — user denied all prompts |
| Browser Cookies/Sessions | BLOCKED — Chrome Safe Storage key denied |
| Crypto Wallet Vaults | BLOCKED — Chrome Safe Storage key required |
| Apple Notes | ATTEMPTED — unclear if successful |
| SSH Keys | NOT ACCESSED |

## Disclosure Timeline

| Date (BRT) | Event |
|------------|-------|
| 2026-06-25 11:47 | Victim clicks idetools.dev link |
| 2026-06-25 11:50:28 | First AI alert |
| 2026-06-25 11:50:29 | +1s — AI identifies malware |
| 2026-06-25 11:52:09 | +101s — LaunchAgent discovered |
| 2026-06-25 11:53:08 | +160s — Containment complete |
| 2026-06-25 ~12:06 | Password rotated |
| 2026-06-25 17:39 | Forensic report published |
| 2026-06-27 13:42 | sj98xe4.xyz suspended |
| 2026-06-29 19:49 | New C2 registered (apdhlhs3.xyz) |
| 2026-07-01 | 6-day follow-up scan |
| 2026-07-02 | BDDR confirmed — new C2 decoded from contract |
| 2026-07-04 | Infection chain fully severed |

## Novelty

1. **BDDR** — C2 URL stored on Polygon smart contract. Domain seizure ineffective; attacker pushes new on-chain tx and all infections pivot instantly.
2. **TouchID bypass** — `osascript display dialog` with zero security semantics. Pixel-perfect fake System Preferences dialog. Never touches PAM.
3. **Supply chain via expired domain** — Not zero-day, not phishing email. Legitimate link in actively-maintained OSS README pointed to expired domain.
4. **AI-assisted IR** — 160-second detection-to-containment. 26x faster than industry average.
5. **Modular C2** — 5 command types dispatched on demand. Attacker escalates capabilities post-infection without re-deploying.

## Source

Forensic repository: `~/workdir/co-fita/redhat-clickfix-report/`

Public report: [ClickFix on macOS: Forensic Report](https://www.linkedin.com/pulse/redhat-clickfix-report-alef-oliveira-dinwf/), published by Alef Oliveira on 2026-08-05. The report is the public source for the documentation trust chain, the 14:50:28 UTC alert, the 16-second active-process observation, the 101-second LaunchAgent discovery and the 160-second containment boundary. It also distinguishes credential capture from collection/upload capability and records the classifier-blindness and decision-collapse taxonomy.

Phase 1 (Jun 25 – Jul 4): Incident Response & Forensic Analysis — Complete.
Phase 2 (Jul 4 – ongoing): Longitudinal Observation — 18h monitoring cycles.

---
*Forensic analysis by [@alefita](https://github.com/aleffita). Discovered 2026-06-25.*