ClickFix Vaccine Branch — Incident Response Toolkit

The vaccine branch of the ClickFix forensic report transforms a static analysis repository into an operational incident response toolkit. It adds three shell scripts (detect.sh, vaccinate.sh, report.sh), a safe killchain simulation, and an agent briefing document that enables autonomous agents to build and refine the toolkit without human intervention.

The core philosophy: "A shell script caused this infection. A shell script can cure it." The malware used curl | bash and osascript -- the same primitives the vaccine uses to detect, neutralize, and document the infection.

See also: clickfix-handoff | clickfix-attack-chain | clickfix-incident-response | clickfix-infrastructure

---

1. What the Vaccine Branch Adds

The original ClickFix report (redhat-clickfix-report/main) is a forensic analysis repository: decoded payloads, stage-by-stage documentation, IOC tables, and a disclosure timeline. The vaccine branch (redhat-clickfix-report-vaccine-branch) extends this into an operational toolkit.

Component	Original (main)	Vaccine Branch
Forensic analysis (analysis/)	Decoded payloads for static analysis	Same -- unchanged
Technical docs (docs/01-07)	Stage-by-stage deep dives	Same -- unchanged
Incident timeline (docs/08)	Not present	Added: 711-event forensic timeline from AI session transcript
Infrastructure analysis (docs/09)	Not present	Added: WHOIS, DNS, hosting, blockchain deep-dive
Passive detection (detect.sh)	Not present	Added: read-only IOC scanner
Active remediation (vaccinate.sh)	Not present	Added: 4-phase "Panic Button"
Report generator (report.sh)	Not present	Added: PII-redacted incident report + GitHub issue draft
Killchain simulation (simulation/)	simulate_clickfix.py only	Added: simulate_full_chain.py (Playwright + macOS UI)
Agent briefing (.agent-briefing.md)	Not present	Added: full task spec for autonomous agent execution

---

2. The Three Vaccine Scripts

2.1 detect.sh -- Passive Diagnostic

A completely read-only scan that checks for signs of ClickFix APT infection. Safe for any user to run -- it never modifies the system.

What it checks (8 categories):

1. Known IOC files: ~/.txid, ~/.passphrase
2. Anomalous LaunchAgents: pattern com.<16 random lowercase chars>.plist
3. Running osascript processes with suspicious arguments
4. Active network connections to known C2 domains/IPs via lsof -i -n -P
5. Payload binaries in ~/Library/<random16chars>
6. TCC database modification timestamps (evidence of tccutil reset All)
7. Suspicious registered launchctl jobs
8. LaunchAgent plist files containing osascript or base64

Exit codes:

• 0 = CLEAN (no indicators)
• 1 = INFECTED (confirmed IOCs detected)
• 2 = SUSPICIOUS (anomalies found, inconclusive)

# Safe for anyone -- read-only, no modifications
bash scripts/detect.sh

The script uses colored output (red for danger, green for clean, yellow for warnings) and prints a structured summary at the end. It requires no dependencies beyond standard macOS tools.

2.2 vaccinate.sh -- Active Remediation ("The Panic Button")

Active remediation with 4 phases and mandatory explicit confirmation.

Phase 1 -- Intelligence Gathering (before any destruction):

• Captures ALL active network connections (lsof -i -n -P)
• Saves connection data to a timestamped log: /tmp/clickfix_vaccine_intel_<timestamp>.log
• Captures full process trees of malicious osascript processes
• Records C2 IPs for the post-remediation report

Phase 2 -- Neutralization:

• Kills malicious osascript/curl processes via kill -9 and pkill
• Unloads LaunchAgents via launchctl bootout gui/<uid> (with unload fallback)
• Removes plist files and payload binaries

Phase 3 -- Cleanup:

• Secure-deletes ~/.passphrase (dd overwrite + rm)
• Removes ~/.txid
• Cleans /tmp/*.zip exfiltration archives

Phase 4 -- Post-Remediation Report:

• Prints what was found, neutralized, exfiltrated, and blocked
• Lists mandatory user actions: password rotation, API key rotation, TCC review
• Offers to run report.sh for shareable incident report

# Requires explicit YES confirmation before any destructive action
bash scripts/vaccinate.sh

Key design decision: intelligence is captured to disk before anything is killed. This preserves forensic evidence that would otherwise be lost during neutralization.

2.3 report.sh -- Incident Report Generator

Consolidates detection/vaccination logs into a PII-redacted incident report in Markdown format.

Redaction rules:

• Real username → [USER]
• Machine UUID → [UUID]
• Hostname → [HOST]
• IOC domains/IPs preserved (attacker infrastructure, not PII)

Output options:

• bash scripts/report.sh -- generate report to stdout
• bash scripts/report.sh --open-github-issue -- generate + open GitHub issue draft in browser
• Falls back to clipboard copy if URL is too long for the GitHub issue body

---

3. The Agent Briefing Protocol

The .agent-briefing.md file is a self-contained task specification designed for autonomous agent execution. It contains:

1. Full attack chain context -- all 4 stages with technical details
2. Complete IOC list -- every domain, IP, contract, and file path
3. 5 numbered tasks with explicit acceptance criteria
4. Quality standards -- set -euo pipefail, colored output, English-only, self-contained
5. Existing repo structure -- so the agent knows what already exists

This pattern enables a single prompt to produce the entire toolkit. The briefing was used to dispatch DeepSeek, which generated all three scripts and the incident timeline in a single session.

Why this matters: The agent briefing is the contract between human intent and agent execution. It specifies WHAT to build (not how), provides full context (so the agent can make independent decisions), and defines quality standards (so the output is production-ready on first pass).

---

4. The Killchain Simulation

The simulation/ directory contains safe reenactments of the attack chain using Playwright and macOS UI scripting.

simulate_clickfix.py (original)

Standalone ClickFix page screenshot capture. Opens the phishing page in a Playwright Chromium browser and captures screenshots of the initial and "verified" states.

simulate_full_chain.py (vaccine branch)

Full killchain reenactment:

• Launches Playwright browser to capture the ClickFix page
• Uses osascript to simulate macOS UI interactions
• Records the entire sequence for documentation purposes
• No real payloads are executed -- the simulation uses safe stand-ins

The simulation produces:

• forensic_evidence/1_initial_state.png -- ClickFix page before interaction
• forensic_evidence/2_verified_state.png -- ClickFix page after "verification"
• forensic_evidence/clipboard_payload.txt -- the injected base64 command
• forensic_evidence/killchain_simulation.mov -- full screen recording

---

5. Forensic Timeline (docs/08)

The vaccine branch adds a minute-by-minute forensic timeline extracted from the Antigravity AI session transcript (JSONL format, 711 events).

Key milestones:

Time (BRT)	Event	Duration
11:47	Victim clicks idetools.dev link	--
11:48	Redirected to ClickFix phishing; clipboard injected	+1 min
11:49	Payload pasted into Terminal; Stage 1 begins	+2 min
11:50:28	First AI alert: "socorro, eu rodei algo idiota"	+3 min
11:50:29	AI identifies malware, instructs Keychain denial	+1 second
11:52:09	LaunchAgent persistence discovered	+101 sec
11:53:08	System declared clean; containment complete	+160 sec
11:53:12	Password theft realized (~/.passphrase found)	+164 sec

The timeline also documents model transitions during the investigation: Claude Opus 4.6 (initial response) → Gemini 3.1 Pro (deep analysis) → Claude Sonnet 4.6 (tool building).

---

6. Infrastructure Analysis (docs/09)

The vaccine branch adds a comprehensive adversary infrastructure analysis covering:

• WHOIS intelligence on all domains (idetools.dev, sessionaquirecheck.pages.dev, maccf9c.jetbet4.online, sj98xe4.xyz, plus the rotated C2 domains apdhlhs3.xyz and j9af4sr.guru)
• DNS records and Cloudflare reverse-proxy configurations
• TLS certificate analysis across all endpoints
• ASN intelligence on 62.60.226.50 (FEMO IT SOLUTIONS, AS214351)
• Blockchain contract bytecode analysis of the Polygon smart contract
• Temporal analysis -- the 40-day campaign window hypothesis and 7 confirmed predictions
• OpSec evolution tracking across 3 C2 rotations

See clickfix-infrastructure for the wikifita synthesis of this analysis.

---

7. Usage Pattern

The intended workflow for an infected macOS user:

# 1. Passive check (safe, read-only)
bash scripts/detect.sh

# 2. If infected, active remediation (requires YES)
bash scripts/vaccinate.sh

# 3. Generate shareable incident report
bash scripts/report.sh

For forensic researchers:

# Fetch the initial payload (Chrome TLS fingerprint bypass)
uv run python scripts/fetch_payload.py

# Decode all base64 layers
uv run python scripts/decode_stages.py

# Query Polygon blockchain for live C2 domain
uv run --with requests python scripts/decode_blockchain_c2.py

# Fetch all C2 modules from live server
uv run --with requests python scripts/fetch_c2_modules.py

# Run safe killchain simulation
uv run python simulation/simulate_full_chain.py

---

8. Design Principles

1. Self-contained scripts -- no dependencies beyond standard macOS tools (bash, lsof, launchctl, pkill, dd, osascript)
2. Read before write -- intelligence gathering always precedes destruction
3. Explicit confirmation -- vaccinate.sh requires typing YES before any destructive action
4. Forensic preservation -- all evidence is logged to /tmp/ before cleanup
5. PII redaction -- reports automatically strip username, hostname, UUID
6. No --no-verify -- scripts follow the same discipline as the git workflow: safety mechanisms exist for a reason