---
name: co-fita-clickfix-vaccine
type: analysis
title: "ClickFix Vaccine Branch — Incident Response Toolkit"
description: "The vaccine branch extends the forensic report with detect/vaccinate/report shell scripts, a safe killchain simulation, and an agent briefing protocol for autonomous incident response."
tags: [security, clickfix, vaccine, incident-response, shell-script, remediation, forensics, automation]
timestamp: "2026-07-21"
---

# ClickFix Vaccine Branch — Incident Response Toolkit

The vaccine branch of the ClickFix forensic report transforms a static analysis repository into an operational incident response toolkit. It adds three shell scripts (`detect.sh`, `vaccinate.sh`, `report.sh`), a safe killchain simulation, and an agent briefing document that enables autonomous agents to build and refine the toolkit without human intervention.

The core philosophy: **"A shell script caused this infection. A shell script can cure it."** The malware used `curl | bash` and `osascript` -- the same primitives the vaccine uses to detect, neutralize, and document the infection.

See also: [[clickfix-handoff]] | [[clickfix-attack-chain]] | [[clickfix-incident-response]] | [[clickfix-infrastructure]]

---

## 1. What the Vaccine Branch Adds

The original ClickFix report (`redhat-clickfix-report/main`) is a forensic analysis repository: decoded payloads, stage-by-stage documentation, IOC tables, and a disclosure timeline. The vaccine branch (`redhat-clickfix-report-vaccine-branch`) extends this into an operational toolkit.

| Component | Original (main) | Vaccine Branch |
|---|---|---|
| Forensic analysis (`analysis/`) | Decoded payloads for static analysis | Same -- unchanged |
| Technical docs (`docs/01-07`) | Stage-by-stage deep dives | Same -- unchanged |
| Incident timeline (`docs/08`) | Not present | Added: 711-event forensic timeline from AI session transcript |
| Infrastructure analysis (`docs/09`) | Not present | Added: WHOIS, DNS, hosting, blockchain deep-dive |
| Passive detection (`detect.sh`) | Not present | Added: read-only IOC scanner |
| Active remediation (`vaccinate.sh`) | Not present | Added: 4-phase "Panic Button" |
| Report generator (`report.sh`) | Not present | Added: PII-redacted incident report + GitHub issue draft |
| Killchain simulation (`simulation/`) | `simulate_clickfix.py` only | Added: `simulate_full_chain.py` (Playwright + macOS UI) |
| Agent briefing (`.agent-briefing.md`) | Not present | Added: full task spec for autonomous agent execution |

---

## 2. The Three Vaccine Scripts

### 2.1 `detect.sh` -- Passive Diagnostic

A **completely read-only** scan that checks for signs of ClickFix APT infection. Safe for any user to run -- it never modifies the system.

**What it checks (8 categories):**

1. Known IOC files: `~/.txid`, `~/.passphrase`
2. Anomalous LaunchAgents: pattern `com.<16 random lowercase chars>.plist`
3. Running `osascript` processes with suspicious arguments
4. Active network connections to known C2 domains/IPs via `lsof -i -n -P`
5. Payload binaries in `~/Library/<random16chars>`
6. TCC database modification timestamps (evidence of `tccutil reset All`)
7. Suspicious registered `launchctl` jobs
8. LaunchAgent plist files containing `osascript` or `base64`

**Exit codes:**
- `0` = CLEAN (no indicators)
- `1` = INFECTED (confirmed IOCs detected)
- `2` = SUSPICIOUS (anomalies found, inconclusive)

```bash
# Safe for anyone -- read-only, no modifications
bash scripts/detect.sh
```

The script uses colored output (red for danger, green for clean, yellow for warnings) and prints a structured summary at the end. It requires no dependencies beyond standard macOS tools.

### 2.2 `vaccinate.sh` -- Active Remediation ("The Panic Button")

Active remediation with **4 phases** and mandatory explicit confirmation.

**Phase 1 -- Intelligence Gathering (before any destruction):**
- Captures ALL active network connections (`lsof -i -n -P`)
- Saves connection data to a timestamped log: `/tmp/clickfix_vaccine_intel_<timestamp>.log`
- Captures full process trees of malicious `osascript` processes
- Records C2 IPs for the post-remediation report

**Phase 2 -- Neutralization:**
- Kills malicious `osascript`/`curl` processes via `kill -9` and `pkill`
- Unloads LaunchAgents via `launchctl bootout gui/<uid>` (with `unload` fallback)
- Removes plist files and payload binaries

**Phase 3 -- Cleanup:**
- Secure-deletes `~/.passphrase` (dd overwrite + rm)
- Removes `~/.txid`
- Cleans `/tmp/*.zip` exfiltration archives

**Phase 4 -- Post-Remediation Report:**
- Prints what was found, neutralized, exfiltrated, and blocked
- Lists mandatory user actions: password rotation, API key rotation, TCC review
- Offers to run `report.sh` for shareable incident report

```bash
# Requires explicit YES confirmation before any destructive action
bash scripts/vaccinate.sh
```

Key design decision: intelligence is captured to disk **before** anything is killed. This preserves forensic evidence that would otherwise be lost during neutralization.

### 2.3 `report.sh` -- Incident Report Generator

Consolidates detection/vaccination logs into a **PII-redacted incident report** in Markdown format.

**Redaction rules:**
- Real username → `[USER]`
- Machine UUID → `[UUID]`
- Hostname → `[HOST]`
- IOC domains/IPs preserved (attacker infrastructure, not PII)

**Output options:**
- `bash scripts/report.sh` -- generate report to stdout
- `bash scripts/report.sh --open-github-issue` -- generate + open GitHub issue draft in browser
- Falls back to clipboard copy if URL is too long for the GitHub issue body

---

## 3. The Agent Briefing Protocol

The `.agent-briefing.md` file is a self-contained task specification designed for autonomous agent execution. It contains:

1. **Full attack chain context** -- all 4 stages with technical details
2. **Complete IOC list** -- every domain, IP, contract, and file path
3. **5 numbered tasks** with explicit acceptance criteria
4. **Quality standards** -- `set -euo pipefail`, colored output, English-only, self-contained
5. **Existing repo structure** -- so the agent knows what already exists

This pattern enables a single prompt to produce the entire toolkit. The briefing was used to dispatch DeepSeek, which generated all three scripts and the incident timeline in a single session.

**Why this matters:** The agent briefing is the contract between human intent and agent execution. It specifies WHAT to build (not how), provides full context (so the agent can make independent decisions), and defines quality standards (so the output is production-ready on first pass).

---

## 4. The Killchain Simulation

The `simulation/` directory contains safe reenactments of the attack chain using Playwright and macOS UI scripting.

### `simulate_clickfix.py` (original)
Standalone ClickFix page screenshot capture. Opens the phishing page in a Playwright Chromium browser and captures screenshots of the initial and "verified" states.

### `simulate_full_chain.py` (vaccine branch)
Full killchain reenactment:
- Launches Playwright browser to capture the ClickFix page
- Uses `osascript` to simulate macOS UI interactions
- Records the entire sequence for documentation purposes
- **No real payloads are executed** -- the simulation uses safe stand-ins

The simulation produces:
- `forensic_evidence/1_initial_state.png` -- ClickFix page before interaction
- `forensic_evidence/2_verified_state.png` -- ClickFix page after "verification"
- `forensic_evidence/clipboard_payload.txt` -- the injected base64 command
- `forensic_evidence/killchain_simulation.mov` -- full screen recording

---

## 5. Forensic Timeline (docs/08)

The vaccine branch adds a minute-by-minute forensic timeline extracted from the Antigravity AI session transcript (JSONL format, 711 events).

**Key milestones:**

| Time (BRT) | Event | Duration |
|---|---|---|
| 11:47 | Victim clicks `idetools.dev` link | -- |
| 11:48 | Redirected to ClickFix phishing; clipboard injected | +1 min |
| 11:49 | Payload pasted into Terminal; Stage 1 begins | +2 min |
| 11:50:28 | First AI alert: "socorro, eu rodei algo idiota" | +3 min |
| 11:50:29 | AI identifies malware, instructs Keychain denial | **+1 second** |
| 11:52:09 | LaunchAgent persistence discovered | +101 sec |
| 11:53:08 | System declared clean; containment complete | **+160 sec** |
| 11:53:12 | Password theft realized (`~/.passphrase` found) | +164 sec |

The timeline also documents model transitions during the investigation: Claude Opus 4.6 (initial response) → Gemini 3.1 Pro (deep analysis) → Claude Sonnet 4.6 (tool building).

---

## 6. Infrastructure Analysis (docs/09)

The vaccine branch adds a comprehensive adversary infrastructure analysis covering:

- **WHOIS intelligence** on all domains (`idetools.dev`, `sessionaquirecheck.pages.dev`, `maccf9c.jetbet4.online`, `sj98xe4.xyz`, plus the rotated C2 domains `apdhlhs3.xyz` and `j9af4sr.guru`)
- **DNS records** and Cloudflare reverse-proxy configurations
- **TLS certificate analysis** across all endpoints
- **ASN intelligence** on `62.60.226.50` (FEMO IT SOLUTIONS, AS214351)
- **Blockchain contract bytecode analysis** of the Polygon smart contract
- **Temporal analysis** -- the 40-day campaign window hypothesis and 7 confirmed predictions
- **OpSec evolution tracking** across 3 C2 rotations

See [[clickfix-infrastructure]] for the wikifita synthesis of this analysis.

---

## 7. Usage Pattern

The intended workflow for an infected macOS user:

```bash
# 1. Passive check (safe, read-only)
bash scripts/detect.sh

# 2. If infected, active remediation (requires YES)
bash scripts/vaccinate.sh

# 3. Generate shareable incident report
bash scripts/report.sh
```

For forensic researchers:
```bash
# Fetch the initial payload (Chrome TLS fingerprint bypass)
uv run python scripts/fetch_payload.py

# Decode all base64 layers
uv run python scripts/decode_stages.py

# Query Polygon blockchain for live C2 domain
uv run --with requests python scripts/decode_blockchain_c2.py

# Fetch all C2 modules from live server
uv run --with requests python scripts/fetch_c2_modules.py

# Run safe killchain simulation
uv run python simulation/simulate_full_chain.py
```

---

## 8. Design Principles

1. **Self-contained scripts** -- no dependencies beyond standard macOS tools (`bash`, `lsof`, `launchctl`, `pkill`, `dd`, `osascript`)
2. **Read before write** -- intelligence gathering always precedes destruction
3. **Explicit confirmation** -- `vaccinate.sh` requires typing `YES` before any destructive action
4. **Forensic preservation** -- all evidence is logged to `/tmp/` before cleanup
5. **PII redaction** -- reports automatically strip username, hostname, UUID
6. **No `--no-verify`** -- scripts follow the same discipline as the git workflow: safety mechanisms exist for a reason