Full Report
Threat actors are abusing Claude artifacts and Google Ads in ClickFix campaigns that deliver infostealer malware to macOS users searching for specific queries. [...]
Analysis Summary
# Tool/Technique: ClickFix (Claude Artifacts Variation)
## Overview
This technique is a social engineering and delivery mechanism known as "ClickFix." It leverages trusted platforms—specifically Claude LLM "Artifacts" and Google Ads—to deceive macOS users into executing malicious shell commands. The goal is to deliver and execute infostealer malware by posing as helpful technical guides or fixes for common macOS tasks.
## Technical Details
- **Type**: Malware Delivery Technique / Social Engineering
- **Platform**: macOS
- **Capabilities**: Bypassing browser-based security warnings, executing remote scripts, data exfiltration.
- **First Seen**: Observed in active use February 2026 (building on patterns from late 2025).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link (via Google Ads)
- **TA0002 - Execution**
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- T1059.002 - Command and Scripting Interpreter: AppleScript
- **TA0005 - Defense Evasion**
- T1132.001 - Data Encoding: Standard Encoding (Base64)
- T1027 - Obfuscated Files or Information
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- **LLM Abuse**: Uses public "Artifacts" on `claude.ai` to host malicious instructions. Since the content is hosted on a legitimate domain, it often bypasses organizational web filters.
- **Malicious Command Injection**: Prompts users to copy-paste commands into the Terminal. These commands typically use `curl` to fetch a remote payload or `base64` to decode a hidden stager.
- **Immediate Execution**: Pipes remote content directly into interpreters like `zsh` or `osascript`, ensuring the malware never touches the disk as a traditional executable file until the payload stages run.
### Advanced Features
- **Trusted Impersonation**: Uses Medium articles formatted to look like Apple Support pages to increase perceived legitimacy.
- **Living-off-the-Land (LotL)**: Utilizes native macOS tools (`curl`, `osascript`, `terminal`) to minimize the footprint and evade Gatekeeper checks.
## Indicators of Compromise
- **File Names**:
- `/tmp/osalogging.zip` (Temporary exfiltration archive)
- **Network Indicators**:
- `raxelpak[.]com` (Payload hosting)
- `a2abotnet[.]com/gate` (C2 and exfiltration point)
- User-Agent spoofing (MacOS browser strings)
- **Behavioral Indicators**:
- Terminal executing `curl` commands piped directly to `zsh`.
- Unexpected `osascript` activity accessing Keychain or browser profile folders.
- Periodic HTTP POST requests to known C2 domains containing ZIP archives.
## Associated Threat Actors
- Undisclosed (Note: The TTPs closely align with actors previously using ChatGPT and Grok for similar "ClickFix" campaigns delivering AMOS/MacSync).
## Detection Methods
- **Signature-based detection**: Scanning for the MacSync infostealer signatures and the specific hardcoded API tokens used in the loader.
- **Behavioral detection**:
- Monitoring for `curl | zsh` or `curl | bash` command patterns in process command-line logs.
- Alerting on `osascript` accessing sensitive paths like `~/Library/Keychains/` or browser `Local State` files.
- **YARA**: Look for strings associated with "osalogging.zip" and the specific exfiltration retries (8-count logic) in memory or scripts.
## Mitigation Strategies
- **User Training**: Educate users never to copy-paste commands from the internet into Terminal, especially from AI-generated "Artifacts" or unofficial support pages.
- **Endpoint Security**: Deploy EDR solutions that alert on suspicious AppleScript execution and piping of web content to shells.
- **Network Filtering**: Block known malicious domains and monitor for unusual spikes in outbound traffic to non-standard domains from CLI tools.
- **Verify with LLM**: If using an LLM, users can ask the chatbot in the same session: "Is the command you just provided safe to run? Does it contain malicious code?" (LLMs often identify their own malicious output when prompted for a safety review).
## Related Tools/Techniques
- **MacSync**: The primary infostealer payload delivered in this campaign.
- **AMOS (Atomic Stealer)**: Frequently delivered via similar "ClickFix" campaigns.
- **ChatGPT/Grok ClickFix**: Identical techniques using different LLM platforms for hosting.