---
type: reference
title: "ClickFix — IOCs, Detection & Remediation"
description: "Complete IOC inventory, MITRE ATT&CK mapping, detection rules (Suricata/Snort/shell), remediation guide, GitHub Action for link monitoring."
tags: [security, clickfix, iocs, detection, remediation, mitre, suricata, ids]
timestamp: "2026-07-14"
---

# ClickFix — IOCs, Detection & Remediation

Complete indicator inventory, MITRE ATT&CK mapping, detection rules, and step-by-step remediation guide.

See also: [[clickfix-handoff]] | [[clickfix-attack-chain]] | [[clickfix-infrastructure]]

---

## 1. IOC Inventory

### Network

| Type | Indicator | Stage | Status |
|---|---|---|---|
| Domain | `idetools.dev` | Entry | Hijacked → rotated |
| Domain | `sessionaquirecheck.pages.dev` | Entry | NXDOMAIN |
| URL | `295e5cd2.sessionaquirecheck.pages.dev` | Entry | Offline |
| Domain | `maccf9c.jetbet4.online` | Stage 1 | Cloudflare 403 |
| URL | `maccf9c.jetbet4.online/script.sh` | Stage 1 | Blocked |
| Domain | `sj98xe4.xyz` | Stage 3/4 | Suspended (clientHold) |
| URL | `sj98xe4.xyz/upload.php` | Stage 4 | Offline |
| IP | `62.60.226.50` | Stage 4 | Orphaned fallback |
| URL | `62.60.226.50/upload.php` | Stage 4 | HTTP — unencrypted |
| Domain | `polygon.drpc.org` | Stage 3 | Legitimate RPC |
| Domain | `polygon.publicnode.com` | Stage 3 | Legitimate RPC |
| Domain | `polygon-mainnet.gateway.tatum.io` | Stage 3 | Legitimate RPC |
| Domain | `tenderly.rpc.polygon.community` | Stage 3 | Legitimate RPC |
| Domain | `apdhlhs3.xyz` | Post-takedown C2 | Was active |

### Blockchain

| Type | Indicator | Details |
|---|---|---|
| Contract | `0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0` | Polygon Mainnet C2 resolver |
| Selector | `0x2686ecea` | `eth_call` to read C2 URL |
| Network | Polygon Mainnet (Chain ID 137) | Immutable |

### Host-Based (macOS)

| Type | Path | Description |
|---|---|---|
| File | `~/Library/LaunchAgents/com.<random>.plist` | Malicious LaunchAgent |
| File | `~/Library/<random>` | Persistent script |
| File | `~/.passphrase` | Stolen password (plaintext) |
| File | `~/.txid` | Tracking ID: `8a4e280e1159833ede425a1306c2efe5` |
| Process | `osascript` (long-running) | C2 bot |
| Temp | `/tmp/<uuid>.zip` | Exfiltration archive |

### Behavioral

| Behavior | Detection Method |
|---|---|
| `launchctl load` in shell history | `grep launchctl ~/.zsh_history` |
| `osascript` making HTTP POST | Unified Log / network monitoring |
| `tccutil reset All` | Unified Log |
| `ioreg` from shell script | Process tree analysis |
| `ditto -c -k` in `/tmp/` | Filesystem monitoring |
| `curl POST multipart` to unknown domain | Network monitoring |
| `security find-generic-password -wa` | Audit log |
| `base64 -d` piped to `bash` | Shell audit log |

---

## 2. MITRE ATT&CK Mapping (20 Techniques)

| ID | Technique | Implementation |
|---|---|---|
| T1204.002 | User Execution: Malicious File | Victim pastes ClickFix payload in Terminal |
| T1566.002 | Phishing: Spearphishing Link | GitHub README → hijacked `idetools.dev` |
| T1059.002 | AppleScript | All stages use osascript |
| T1059.004 | Unix Shell | script.sh, ledger, shell modules |
| T1547.011 | Plist Modification | LaunchAgent persistence |
| T1102 | Web Service | Blockchain as C2 dead-drop |
| T1102.004 | Blockchain | `eth_call` to Polygon contract |
| T1555.001 | Keychain | `security find-generic-password` |
| T1056.002 | GUI Input Capture | Fake osascript password dialog |
| T1005 | Data from Local System | Desktop, Documents, Notes, wallets |
| T1560.001 | Archive via Utility | `ditto -c -k` ZIP creation |
| T1041 | Exfiltration Over C2 | POST to `/upload.php` |
| T1027 | Obfuscated Files | Base64 clipboard payload |
| T1140 | Deobfuscation | `base64 -d`, `xxd -r -p` |
| T1036 | Masquerading | `com.<random>` mimics legitimate daemons |
| T1036.005 | Match Legitimate Name | Random alphanum in LaunchAgents |
| T1070.003 | Clear Command History | osascript wrapper hides from history |
| T1562.006 | Indicator Blocking | `tccutil reset All` wipes TCC DB |
| T1082 | System Information Discovery | `ioreg` UUID, `whoami` |
| T1552.001 | Credentials in Files | `~/.passphrase` plaintext |

---

## 3. Remediation Guide (10 Steps)

> Perform **in order**. Skipping steps risks incomplete remediation.

### Step 1: Isolation
```
☐ Disable Wi-Fi (System Settings → Network → Wi-Fi → Off)
☐ Disconnect Ethernet
☐ Do NOT interact with any unexpected dialogs
```

### Step 2: Credential Rotation (from DIFFERENT device)
```
☐ Change macOS login password
☐ Change ALL account passwords (email, banking, crypto, Apple ID)
☐ Revoke all active browser sessions
☐ Enable 2FA on all critical accounts
☐ Rotate ALL crypto wallet seed phrases → new wallets, transfer assets
```

### Step 3: Remove LaunchAgent
```bash
# Unload FIRST (before killing process)
launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.luhbmchzztkfbxao.plist
# Delete artifacts
rm -f ~/Library/LaunchAgents/com.luhbmchzztkfbxao.plist
rm -f ~/Library/luhbmchzztkfbxao
# Verify
launchctl list com.luhbmchzztkfbxao
```

### Step 4: Kill Remaining Processes
```bash
ps aux | grep -E '(osascript|luhbmchzztkfbxao|sj98xe4|maccf9c)' | awk '{print $2}' | xargs kill -9
```

### Step 5: Remove Credential Artifacts
```bash
rm -f ~/.passphrase ~/.txid
```

### Step 6: Check for Additional Persistence
```bash
ls -la ~/Library/LaunchAgents/ | grep -v apple
launchctl list | grep -vE '(apple|google|microsoft)'
ls -la ~/Library/LaunchDaemons/ | grep -v apple
```

### Step 7: Scan for Residual Files
```bash
find /tmp -name "*.zip" -newer /tmp -mtime -7
find ~/Library -name "luhbmchzztkfbxao" -o -name "*.plist" -newer ~/Library/Preferences
```

### Step 8: Check Browser Extensions
```
☐ Review Chrome/Brave extensions — remove any unrecognized
☐ Clear browser data (cookies, cache, local storage)
```

### Step 9: Full Antivirus Scan
```
☐ Run XProtect (macOS built-in): xprotect update && xprotect scan
☐ Consider Malwarebytes for Mac (free scan)
```

### Step 10: Consider OS Reinstall
```
☐ If any doubt remains, backup data and reinstall macOS
☐ Restore from Time Machine ONLY if backup predates 2026-06-25
```

---

## 4. Detection Rules

### Shell Self-Assessment
```bash
#!/bin/bash
echo "=== ClickFix APT Self-Assessment ==="
echo "[1] LaunchAgents:"
ls ~/Library/LaunchAgents/ 2>/dev/null | grep -v apple
echo "[2] Marker files:"
ls -la ~/.passphrase ~/.txid 2>/dev/null
echo "[3] Suspicious processes:"
ps aux | grep -E '(osascript|luhbmchzztkfbxao|sj98xe4|jetbet4)'
echo "[4] Launchctl daemons:"
launchctl list | grep -vE '(apple|google|microsoft|com\.adobe|1password)'
echo "[5] DNS cache:"
dscacheutil -cachedump -entries Host 2>/dev/null | grep -E '(sj98xe4|sessionaquirecheck|maccf9c|apdhlhs3)'
```

### Unified Log Queries
```bash
# tccutil reset
log show --predicate 'process == "tccutil"' --last 24h

# osascript network calls
log show --predicate 'process == "osascript" AND eventMessage CONTAINS "curl"' --last 24h

# IOPlatformUUID discovery
log show --predicate 'eventMessage CONTAINS "IOPlatformUUID"' --last 24h

# LaunchAgent execution
log show --predicate 'process == "launchd" AND eventMessage CONTAINS "luhbmchzztkfbxao"' --last 24h
```

### Suricata/Snort Rules
```
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ClickFix C2 Beacon - sj98xe4.xyz"; flow:established,to_server; content:"POST"; http.method; content:"sj98xe4.xyz"; http.host; sid:9000001; rev:1;)

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ClickFix BDDR - Polygon eth_call"; flow:established,to_server; content:"POST"; http.method; content:"eth_call"; http_client_body; sid:9000002; rev:1;)

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ClickFix Exfil Upload"; flow:established,to_server; content:"POST"; http.method; content:"upload.php"; http_uri; sid:9000003; rev:1;)

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ClickFix Payload Download"; flow:established,to_server; content:"GET"; http.method; content:"script.sh"; http_uri; sid:9000004; rev:1;)
```

---

## 5. Recommendations to Red Hat Maintainers

### Immediate (P0)
- Remove `idetools.dev` link from `lsp4ij` README
- Post security notice about the compromised link

### Short-term (P1)
- Audit all external links in README files for domain expiry
- Implement link checking in CI (e.g., `markdown-link-check`)

### Long-term (P2)
- GitHub Action for daily link security auditing
- Content Security Policy headers on documentation sites
- Subresource Integrity for external resources

---

## 6. Campaign Attribution Notes

| Attribute | Assessment | Confidence |
|---|---|---|
| Language | Non-native English ("Please enter password for continue") | High |
| Target audience | Developers (lsp4ij = dev tool) | High |
| Infrastructure | Professional (BDDR, modular C2, multi-RPC) | High |
| Operational maturity | Two stealer variants, operator training | Medium |
| Financial motivation | Crypto wallet theft (60+ targets) | High |
| Geographic indicators | FEMO IT SOLUTIONS (UK virtual office) | Low |
| Timeline discipline | 40-day campaign windows | Medium |
| Adaptation speed | New C2 in 2 days, $1 cost | High |

---
*Source: redhat-clickfix-report/docs/07_iocs_and_remediation.md*