ClickFix APT — Handoff

Status (2026-07-04): INFECTION CHAIN FULLY SEVERED. Entry domain re-purposed, phishing page removed, payload blocked by Cloudflare (403), original C2 suspended, new C2 orphaned. Infrastructure dismantled in 9 days.

TL;DR

A link in the official redhat-developer/lsp4ij README — idetools.dev — redirected to an active malware campaign. The expired domain was hijacked by attackers running a 4-stage macOS infostealer backed by a Polygon blockchain-based C2 resolver (BDDR). The attack was contained in 160 seconds with AI assistance. The attacker adapted by registering a new C2 domain 2 days after takedown, confirming the BDDR technique works in practice.

Attack Flow

Victim clicks idetools.dev link (lsp4ij README)
    → 302 → sessionaquirecheck.pages.dev (ClickFix CAPTCHA)
    → clipboard injection (base64 payload)
    → curl | bash downloads script.sh
    → LaunchAgent persistence + fake PAM password dialog
    → bmodule polls Polygon smart contract → resolves C2 domain
    → C2 dispatches: smodule/lmodule stealer, ledger stub, reverse shell

Detailed pages:

clickfix-attack-chain — Domain hijack, ClickFix, persistence, fake PAM
clickfix-bddr — Blockchain Dead-Drop Resolver
clickfix-c2-bot — C2 bot architecture, command dispatch
clickfix-stealers — Infostealer modules (60 wallet targets)
clickfix-iocs — IOC inventory, MITRE ATT&CK, detection, remediation
clickfix-incident-response — 160-second containment, AI-assisted IR
clickfix-infrastructure — Temporal analysis, 40-day window, monitoring

IOC Summary

Network

Type	Indicator	Role	Status
Domain	`idetools.dev`	Hijacked blog link	Rotated → survey-smiles.com
Domain	`sessionaquirecheck.pages.dev`	ClickFix phishing host	NXDOMAIN
Domain	`maccf9c.jetbet4.online`	Stage 1 payload server	Cloudflare 403
Domain	`sj98xe4.xyz`	Original C2	Suspended (clientHold)
Domain	`apdhlhs3.xyz`	New C2 (post-takedown)	Was active
Domain	`j9af4sr.guru`	Third C2 rotation	Latest observed
IP	`62.60.226.50`	Hardcoded fallback C2	Orphaned

Blockchain

Type	Indicator
Contract	`0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0` (Polygon)
Selector	`0x2686ecea`
Network	Polygon Mainnet

Host-Based (macOS)

Path	Description
`~/Library/LaunchAgents/com.<random16>.plist`	Persistence daemon
`~/Library/<random16>`	Main malware script
`~/.txid`	Victim tracking ID
`~/.passphrase`	Stolen password (plaintext)

What Was Stolen vs. Blocked

Data	Status
macOS Admin Password	EXFILTRATED — rotated within 13 minutes
Keychain Passwords	BLOCKED — user denied all prompts
Browser Cookies/Sessions	BLOCKED — Chrome Safe Storage key denied
Crypto Wallet Vaults	BLOCKED — Chrome Safe Storage key required
Apple Notes	ATTEMPTED — unclear if successful
SSH Keys	NOT ACCESSED

Disclosure Timeline

Date (BRT)	Event
2026-06-25 11:47	Victim clicks idetools.dev link
2026-06-25 11:50:28	First AI alert
2026-06-25 11:50:29	+1s — AI identifies malware
2026-06-25 11:52:09	+101s — LaunchAgent discovered
2026-06-25 11:53:08	+160s — Containment complete
2026-06-25 ~12:06	Password rotated
2026-06-25 17:39	Forensic report published
2026-06-27 13:42	sj98xe4.xyz suspended
2026-06-29 19:49	New C2 registered (apdhlhs3.xyz)
2026-07-01	6-day follow-up scan
2026-07-02	BDDR confirmed — new C2 decoded from contract
2026-07-04	Infection chain fully severed

Novelty

BDDR — C2 URL stored on Polygon smart contract. Domain seizure ineffective; attacker pushes new on-chain tx and all infections pivot instantly.
TouchID bypass — osascript display dialog with zero security semantics. Pixel-perfect fake System Preferences dialog. Never touches PAM.
Supply chain via expired domain — Not zero-day, not phishing email. Legitimate link in actively-maintained OSS README pointed to expired domain.
AI-assisted IR — 160-second detection-to-containment. 26x faster than industry average.
Modular C2 — 5 command types dispatched on demand. Attacker escalates capabilities post-infection without re-deploying.

Source

Forensic repository: ~/workdir/co-fita/redhat-clickfix-report/

Public report: ClickFix on macOS: Forensic Report, published by Alef Oliveira on 2026-08-05. The report is the public source for the documentation trust chain, the 14:50:28 UTC alert, the 16-second active-process observation, the 101-second LaunchAgent discovery and the 160-second containment boundary. It also distinguishes credential capture from collection/upload capability and records the classifier-blindness and decision-collapse taxonomy.

Phase 1 (Jun 25 – Jul 4): Incident Response & Forensic Analysis — Complete. Phase 2 (Jul 4 – ongoing): Longitudinal Observation — 18h monitoring cycles.

Forensic analysis by @alefita. Discovered 2026-06-25.