New Matryoshka Clickfix Variant Exploits macOS to Deploy Stealer Malware

Key Takeaways

• A new macOS threat, “Matryoshka ClickFix,” employs sophisticated social engineering and multi-layered obfuscation to deliver stealer malware.
• The attack leverages typosquatting domains to trick users into executing malicious Terminal commands, bypassing standard security measures.
• Matryoshka targets browser credentials and cryptocurrency wallet applications like Trezor Suite and Ledger Live.
• The malware utilizes advanced evasion techniques, including in-memory execution and rapid process termination, to avoid detection.
• Users are advised against pasting unsolicited commands into Terminal and organizations should enhance domain blocking and execution monitoring.

Matryoshka ClickFix: A New macOS Threat Exploiting Social Engineering and Advanced Evasion

macOS users are confronting an escalating threat from a sophisticated social engineering campaign that deploys stealer malware through an advanced iteration of the ClickFix attack technique. This new variant, dubbed “Matryoshka” by researchers, draws its name from Russian nesting dolls, reflecting its use of multiple obfuscation layers to conceal malicious code from security tools and automated analysis systems.

The attack chain is designed to deceive victims into executing seemingly legitimate software “fix” commands directly in their Terminal application. This method cleverly circumvents the typical user expectation of downloading and launching an application, a common vector for traditional macOS malware.

The campaign initiates by exploiting typosquatting domains, which are meticulously crafted to mimic legitimate websites. These fraudulent domains intercept users who inadvertently misspell genuine web addresses, particularly those seeking software review sites. Once redirected to one of these deceptive sites, victims are presented with a fake installation prompt instructing them to paste a “fix” command into their macOS Terminal application.

Analysts at Intego identified this intricate attack chain after observing domains such as comparisions[.]org, which closely resembles the legitimate comparisons.org website through the addition of a single character.

Unlike previous ClickFix iterations that often relied on more readable scripts, Matryoshka incorporates advanced evasion tactics to complicate detection. The malicious payload remains encoded and compressed until its execution, decompressing directly into memory rather than writing discernible script files to disk. This in-memory execution significantly reduces the visibility of the threat to file-based security scanners and makes basic static analysis considerably more challenging for security researchers.

Upon successful execution, the loader retrieves an AppleScript payload specifically engineered to harvest credentials from web browsers and target cryptocurrency wallet applications, including Trezor Suite and Ledger Live. The malware initially attempts programmatic credential theft but, if unsuccessful, resorts to displaying persistent, fake system dialogs that repeatedly prompt users for their passwords until they comply.

Infection Mechanism and Evasion Tactics

The Matryoshka infection chain operates through a series of stages, each meticulously designed to evade detection while maintaining operational efficiency. When a victim pastes the malicious Terminal command, it retrieves a shell script containing a substantial encoded payload embedded within a heredoc structure. This payload then progresses through an in-memory pipeline, where it undergoes decoding and decompression without generating easily detectable file artifacts on the system.

The loader exhibits several astute evasion behaviors that contribute to its stealthy operation. It detaches its primary routine to the background and exits rapidly, causing the Terminal prompt to return almost immediately, thereby leading victims to believe the process has concluded. The script also redirects standard input, output, and error streams to suppress any visible artifacts within the terminal session. Furthermore, the command-and-control (C2) infrastructure requires specific custom headers in requests, responding with generic errors to automated scanners that lack the proper credentials, further hindering analysis.

What You Should Do

• Never Paste Unknown Commands: Absolutely avoid pasting commands from websites directly into your macOS Terminal application unless you fully understand their function and the source is unequivocally trusted. Legitimate software updates or fixes rarely, if ever, require this action.
• Be Wary of Typosquatting: Exercise extreme caution when typing website addresses. Double-check URLs for subtle misspellings before clicking links or entering sensitive information. Consider using a password manager that can autofill credentials only on legitimate sites.
• Monitor Terminal Activity: Organizations should implement robust monitoring solutions to detect unusual Terminal-initiated execution patterns, especially those involving shell scripts or unexpected background processes.
• Educate Users: Conduct regular cybersecurity awareness training for all users, emphasizing the dangers of social engineering, typosquatting, and the risks associated with executing unknown commands.
• Implement Endpoint Detection and Response (EDR): Deploy EDR solutions capable of detecting in-memory execution, process injection, and other advanced evasion techniques used by malware like Matryoshka.
• Protect Cryptocurrency Wallets: Users of cryptocurrency applications like Trezor Suite and Ledger Live should be particularly vigilant and ensure their software is always updated to the latest version. Never enter wallet passwords or seed phrases into unexpected prompts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.