ClickFix — IOCs, Detection & Remediation
Complete indicator inventory, MITRE ATT&CK mapping, detection rules, and step-by-step remediation guide.
See also: clickfix-handoff | clickfix-attack-chain | clickfix-infrastructure
1. IOC Inventory
Network
| Type | Indicator | Stage | Status |
|---|
| Domain | idetools.dev | Entry | Hijacked → rotated |
| Domain | sessionaquirecheck.pages.dev | Entry | NXDOMAIN |
| URL | 295e5cd2.sessionaquirecheck.pages.dev | Entry | Offline |
| Domain | maccf9c.jetbet4.online | Stage 1 | Cloudflare 403 |
| URL | maccf9c.jetbet4.online/script.sh | Stage 1 | Blocked |
| Domain | sj98xe4.xyz | Stage 3/4 | Suspended (clientHold) |
| URL | sj98xe4.xyz/upload.php | Stage 4 | Offline |
| IP | 62.60.226.50 | Stage 4 | Orphaned fallback |
| URL | 62.60.226.50/upload.php | Stage 4 | HTTP — unencrypted |
| Domain | polygon.drpc.org | Stage 3 | Legitimate RPC |
| Domain | polygon.publicnode.com | Stage 3 | Legitimate RPC |
| Domain | polygon-mainnet.gateway.tatum.io | Stage 3 | Legitimate RPC |
| Domain | tenderly.rpc.polygon.community | Stage 3 | Legitimate RPC |
| Domain | apdhlhs3.xyz | Post-takedown C2 | Was active |
Blockchain
| Type | Indicator | Details |
|---|
| Contract | 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0 | Polygon Mainnet C2 resolver |
| Selector | 0x2686ecea | eth_call to read C2 URL |
| Network | Polygon Mainnet (Chain ID 137) | Immutable |
Host-Based (macOS)
| Type | Path | Description |
|---|
| File | ~/Library/LaunchAgents/com.<random>.plist | Malicious LaunchAgent |
| File | ~/Library/<random> | Persistent script |
| File | ~/.passphrase | Stolen password (plaintext) |
| File | ~/.txid | Tracking ID: 8a4e280e1159833ede425a1306c2efe5 |
| Process | osascript (long-running) | C2 bot |
| Temp | /tmp/<uuid>.zip | Exfiltration archive |
Behavioral
| Behavior | Detection Method |
|---|
launchctl load in shell history | grep launchctl ~/.zsh_history |
osascript making HTTP POST | Unified Log / network monitoring |
tccutil reset All | Unified Log |
ioreg from shell script | Process tree analysis |
ditto -c -k in /tmp/ | Filesystem monitoring |
curl POST multipart to unknown domain | Network monitoring |
security find-generic-password -wa | Audit log |
base64 -d piped to bash | Shell audit log |
2. MITRE ATT&CK Mapping (20 Techniques)
| ID | Technique | Implementation |
|---|
| T1204.002 | User Execution: Malicious File | Victim pastes ClickFix payload in Terminal |
| T1566.002 | Phishing: Spearphishing Link | GitHub README → hijacked idetools.dev |
| T1059.002 | AppleScript | All stages use osascript |
| T1059.004 | Unix Shell | script.sh, ledger, shell modules |
| T1547.011 | Plist Modification | LaunchAgent persistence |
| T1102 | Web Service | Blockchain as C2 dead-drop |
| T1102.004 | Blockchain | eth_call to Polygon contract |
| T1555.001 | Keychain | security find-generic-password |
| T1056.002 | GUI Input Capture | Fake osascript password dialog |
| T1005 | Data from Local System | Desktop, Documents, Notes, wallets |
| T1560.001 | Archive via Utility | ditto -c -k ZIP creation |
| T1041 | Exfiltration Over C2 | POST to /upload.php |
| T1027 | Obfuscated Files | Base64 clipboard payload |
| T1140 | Deobfuscation | base64 -d, xxd -r -p |
| T1036 | Masquerading | com.<random> mimics legitimate daemons |
| T1036.005 | Match Legitimate Name | Random alphanum in LaunchAgents |
| T1070.003 | Clear Command History | osascript wrapper hides from history |
| T1562.006 | Indicator Blocking | tccutil reset All wipes TCC DB |
| T1082 | System Information Discovery | ioreg UUID, whoami |
| T1552.001 | Credentials in Files | ~/.passphrase plaintext |
3. Remediation Guide (10 Steps)
Perform in order. Skipping steps risks incomplete remediation.
Step 1: Isolation
☐ Disable Wi-Fi (System Settings → Network → Wi-Fi → Off)
☐ Disconnect Ethernet
☐ Do NOT interact with any unexpected dialogs
Step 2: Credential Rotation (from DIFFERENT device)
☐ Change macOS login password
☐ Change ALL account passwords (email, banking, crypto, Apple ID)
☐ Revoke all active browser sessions
☐ Enable 2FA on all critical accounts
☐ Rotate ALL crypto wallet seed phrases → new wallets, transfer assets
Step 3: Remove LaunchAgent
launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.luhbmchzztkfbxao.plist
rm -f ~/Library/LaunchAgents/com.luhbmchzztkfbxao.plist
rm -f ~/Library/luhbmchzztkfbxao
launchctl list com.luhbmchzztkfbxao
Step 4: Kill Remaining Processes
ps aux | grep -E '(osascript|luhbmchzztkfbxao|sj98xe4|maccf9c)' | awk '{print $2}' | xargs kill -9
Step 5: Remove Credential Artifacts
rm -f ~/.passphrase ~/.txid
Step 6: Check for Additional Persistence
ls -la ~/Library/LaunchAgents/ | grep -v apple
launchctl list | grep -vE '(apple|google|microsoft)'
ls -la ~/Library/LaunchDaemons/ | grep -v apple
Step 7: Scan for Residual Files
find /tmp -name "*.zip" -newer /tmp -mtime -7
find ~/Library -name "luhbmchzztkfbxao" -o -name "*.plist" -newer ~/Library/Preferences
Step 8: Check Browser Extensions
☐ Review Chrome/Brave extensions — remove any unrecognized
☐ Clear browser data (cookies, cache, local storage)
Step 9: Full Antivirus Scan
☐ Run XProtect (macOS built-in): xprotect update && xprotect scan
☐ Consider Malwarebytes for Mac (free scan)
Step 10: Consider OS Reinstall
☐ If any doubt remains, backup data and reinstall macOS
☐ Restore from Time Machine ONLY if backup predates 2026-06-25
4. Detection Rules
Shell Self-Assessment
#!/bin/bash
echo "=== ClickFix APT Self-Assessment ==="
echo "[1] LaunchAgents:"
ls ~/Library/LaunchAgents/ 2>/dev/null | grep -v apple
echo "[2] Marker files:"
ls -la ~/.passphrase ~/.txid 2>/dev/null
echo "[3] Suspicious processes:"
ps aux | grep -E '(osascript|luhbmchzztkfbxao|sj98xe4|jetbet4)'
echo "[4] Launchctl daemons:"
launchctl list | grep -vE '(apple|google|microsoft|com\.adobe|1password)'
echo "[5] DNS cache:"
dscacheutil -cachedump -entries Host 2>/dev/null | grep -E '(sj98xe4|sessionaquirecheck|maccf9c|apdhlhs3)'
Unified Log Queries
log show --predicate 'process == "tccutil"' --last 24h
log show --predicate 'process == "osascript" AND eventMessage CONTAINS "curl"' --last 24h
log show --predicate 'eventMessage CONTAINS "IOPlatformUUID"' --last 24h
log show --predicate 'process == "launchd" AND eventMessage CONTAINS "luhbmchzztkfbxao"' --last 24h
Suricata/Snort Rules
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ClickFix C2 Beacon - sj98xe4.xyz"; flow:established,to_server; content:"POST"; http.method; content:"sj98xe4.xyz"; http.host; sid:9000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ClickFix BDDR - Polygon eth_call"; flow:established,to_server; content:"POST"; http.method; content:"eth_call"; http_client_body; sid:9000002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ClickFix Exfil Upload"; flow:established,to_server; content:"POST"; http.method; content:"upload.php"; http_uri; sid:9000003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ClickFix Payload Download"; flow:established,to_server; content:"GET"; http.method; content:"script.sh"; http_uri; sid:9000004; rev:1;)
5. Recommendations to Red Hat Maintainers
Immediate (P0)
- Remove
idetools.dev link from lsp4ij README
- Post security notice about the compromised link
Short-term (P1)
- Audit all external links in README files for domain expiry
- Implement link checking in CI (e.g.,
markdown-link-check)
Long-term (P2)
- GitHub Action for daily link security auditing
- Content Security Policy headers on documentation sites
- Subresource Integrity for external resources
6. Campaign Attribution Notes
| Attribute | Assessment | Confidence |
|---|
| Language | Non-native English ("Please enter password for continue") | High |
| Target audience | Developers (lsp4ij = dev tool) | High |
| Infrastructure | Professional (BDDR, modular C2, multi-RPC) | High |
| Operational maturity | Two stealer variants, operator training | Medium |
| Financial motivation | Crypto wallet theft (60+ targets) | High |
| Geographic indicators | FEMO IT SOLUTIONS (UK virtual office) | Low |
| Timeline discipline | 40-day campaign windows | Medium |
| Adaptation speed | New C2 in 2 days, $1 cost | High |
Source: redhat-clickfix-report/docs/07_iocs_and_remediation.md