macOS ClickFix Crimekit Uses Polygon Smart Contracts to Deploy AMOS Stealer and XMRig Miner

A macOS-focused ClickFix campaign is abusing Polygon smart contracts to conceal its live command-and-control infrastructure while deploying an Atomic macOS Stealer (AMOS) variant, a persistent backdoor, and an XMRig cryptominer.

The operation combines fake CAPTCHA social engineering with EtherHiding, making infrastructure rotation far more resilient than traditional hardcoded C2 schemes.

The command decodes to a curl | bash pipeline that retrieves a payload from a Cloudflare Worker and executes it without a conventional downloaded application.

This bypasses the familiar download-and-double-click flow that macOS users associate with untrusted software warnings.

The Worker returns an obfuscated AppleScript launched through the legitimate macOS utility osascript.

Decoded layers write a LaunchAgent for persistence and install an AppleScript loader designed to evade static inspection through character-by-character string construction and junk values.

The resulting persistence artifact uses the LaunchAgent label com.ifipbqmfnnywqguz, with RunAtLoad and KeepAlive ensuring the malware restarts after reboot or termination.

The loader does not embed a C2 domain. Instead, it sends read-only eth_call requests to public Polygon RPC services and retrieves the C2 hostname from smart contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0.

This is EtherHiding: attacker-controlled configuration is stored in public blockchain state and fetched only at runtime.

The contract’s getter function, invoked through selector 0x2686ecea, returned the active C2 67sixcebeh[.]surf during the investigation.

Because a read-only contract query creates no wallet transaction or gas fee, victim activity does not appear on-chain.

However, the operator’s C2 changes are permanently recorded as setter transactions, enabling defenders to reconstruct historical infrastructure and monitor future rotations.

The first retrieved module, bmodule, acts as the persistent agent rather than the final stealer. It fingerprints the system using the IOPlatformUUID and username, re-resolves the C2 through Polygon, and registers the host with the operator.

It also displays a counterfeit “System Preferences” password dialog, repeatedly validating entered credentials through dscl . authonly before storing successful credentials in ~/.passphrase.

NetbyteSEC Researchers said that, Similar macOS ClickFix campaigns have used blockchain-resolved C2 services to resist DNS-based disruption and rapidly change payload infrastructure.

Crimekit Uses Polygon Smart Contracts

The agent polls its C2 every 60 seconds and accepts commands that can deploy the full AMOS payload (smodule), a lighter AMOS variant (lmodule), an XMRig deployment script (ledger), or an interactive shell.

The campaign begins on a Cloudflare Pages-hosted fake “TrustKey” human-verification site. Visitors see a familiar “I’m not a robot” prompt, but clicking it silently copies a malicious command to the clipboard and instructs victims to open Terminal via Spotlight, paste the “token,” and press Return.

It can also reset macOS TCC permissions using tccutil reset All, potentially disrupting privacy-control state and helping subsequent malicious activity.

This architecture is operationally important: removing only XMRig or a stealer payload is insufficient. The persistent agent can receive a replacement task and reinstall components on demand.

Enrolls the victim the agent sends a &connect request to register the compromised host. When it receives newconnect, it runs tccutil reset All, resetting the machine’s TCC privacy permissions.

The full AMOS module targets browser cookies, saved credentials, history, Keychain databases, browser Safe Storage keys, Telegram session data, Apple Notes, Safari cookies, desktop cryptocurrency wallets, and browser-extension wallet data.

It also searches Desktop and Documents directories before compressing collected material with ditto and uploading it through curl.

The stealer includes the AMOS-associated txid value 427e8b573407f6029923cdb4686b5f77, used to route collected data through operator infrastructure.

It routes archives larger than 90 MB to http://62.60.226.0/upload.php, while smaller archives are sent to C2-hosted upload endpoints.

For monetization beyond credential theft, the ledger task kills existing XMRig processes and downloads an XMRig script from the active C2.

The script detects Apple Silicon versus Intel hardware, retrieves XMRig 6.26.0 from its official GitHub source, strips the quarantine attribute, and runs it against a TLS-enabled Monero mining pool.

The use of an otherwise legitimate miner complicates simplistic signature-only detection; the malicious configuration, persistence chain, and sustained CPU consumption provide stronger hunting opportunities.

Defenders should hunt for Terminal-launched curl | bash commands, suspicious osascript -e execution, new LaunchAgents, public Polygon RPC traffic from endpoints, and eth_call queries targeting the identified contract.

Monitoring the contract and its controlling wallet offers a durable pivot even when C2 domains are rotated. EtherHiding shifts the defensive focus from blocking one domain to tracking the persistent on-chain infrastructure and eliminating the resident backdoor agent.

Indicators of Compromise

URL	Domain	IP
https://25382ea9.trustkey-otcheckv1[.]pages.dev	hf98x4d.site	162.159.36.12
https://winter-leaf-8941.adrianroy-01[.]workers.dev	xuiaxwx.com	104.21.4.95
https://67sixcebeh[.]surf/upload.php	gesck4m.pro	62.60.226.0
https://67sixcebeh[.]surf/xmr	sj98xe4.xyz
https://black-feather-9cfd.adrianroy-01[.]workers.dev	smdh7.surf
	citcix6.xyz
	67sixcebeh.surf

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide