Malware
Macfinger ClickFix delivers architecture‑specific info‑stealer via shell‑script loader
A macOS 27.0 machine was infected by the Macfinger ClickFix campaign, which uses a shell script to download an architecture‑specific binary that steals credentials and persists in the user cache. The payload runs as com.apple.periodic and can survive reboots. Defenders should block the attacker IP, monitor the cache directory, and terminate any com.apple.periodic processes.
What happened
On 24 Sep 2026 a macOS 27.0 machine was infected by the Macfinger ClickFix campaign. The attacker delivered a shell script that downloaded an architecture‑specific Mach‑O binary and installed it under /Library/Caches/com.apple.securityd/com.apple.periodic.
Technical details
- Loader script is a shell script fetched from 45.131.215.56. It checks the host architecture with uname -m and pulls the matching binary.
- For Apple‑silicon hosts it downloads the arm64 binary from 45.131.215.56; for Intel hosts it pulls the x86_64 binary from the same IP.
- The binary is named com.apple.periodic and is executed as a background process. If a previous instance is running, the script terminates it before launching the new one.
- Once running, the payload collects credential data and other sensitive information, then exfiltrates it to the attacker’s command and control server.
Impact
Any macOS machine running the affected OS version can become a data‑stealing endpoint. The malware persists by residing in the user’s cache directory and can survive reboots until the binary is removed.
Mitigation
- Block outbound traffic to 45.131.215.56 and the hollow‑badger‑moasfraum.life domain.
- Monitor /Library/Caches/com.apple.securityd/ for new or modified files named com.apple.periodic.
- Terminate any running com.apple.periodic processes and delete the binary.
- Disable execution of unsigned shell scripts in user cache directories via Gatekeeper or MDM restrictions.
- Apply the latest macOS security updates and enforce least‑privilege execution policies.
Related articles
ClickFix Campaign Compromises Ukrainian Sites, Deploys Psychedelic Stealer via Fake Cloudflare Verification
An active ClickFix campaign has injected fake Cloudflare verification pages into legitimate Ukrainian business sites, tricking visitors into running an MSI installer that delivers the Psychedelic stealer. The malware harvests credentials, cryptocurrency wallet data, and establishes persistence via scheduled tasks. Defenders should block the attacker domains, detect MSI executions, and harden web applications against iframe injection.
Read briefing
PIKABOT Loader Update: New Unpacking, Obfuscation, and Phishing Campaigns
Elastic Security Labs uncovered a new PIKABOT loader variant that uses scattered base64 chunks, inline RC4 decryption, and plaintext configuration to evade detection. The campaign delivers the loader via ZIP attachments in phishing emails and launches PowerShell to download the payload. Defenders should block ZIPs from unknown senders, monitor for suspicious PowerShell activity, and update detection rules for the new unpacking pattern.
Read briefing
PhantomRaven: LLM‑Generated JavaScript Info Stealer Used by Bug‑Bounty‑Hunter Threat Actor
CrowdStrike uncovered PhantomRaven, a JavaScript‑based information stealer created by a financially motivated threat actor who masquerades as a bug bounty hunter. The tool harvests credentials and sensitive data from compromised web pages. Defenders should block known malicious script domains, enforce strict content‑security policies, and monitor for anomalous data exfiltration.
Read briefing
PhantomRaven: JavaScript Info Stealer Developed by Bug‑Bounty Threat Actor
CrowdStrike uncovered PhantomRaven, a JavaScript‑based information stealer created by a financially motivated threat actor who operates as a bug‑bounty hunter. The malware targets web applications, harvesting credentials and sensitive data via injected scripts. Defenders should inspect client‑side code, enforce strict CSP, and monitor for anomalous JavaScript activity.
Read briefing