Full Report
A single X DM split into two malware chains: AMOS stealer on Mac, NetSupport Manager on Windows, see the Huntress SOC analyst breakdown.
Analysis Summary
# Tool/Technique: ClickFix (Google Apps Script Variant)
## Overview
This attack involves a multi-stage social engineering and delivery mechanism utilizing a legitimate Google Doc with a malicious **Google Apps Script** sidebar. The technique acts as a platform-aware "triage and delivery" funnel, redirecting victims to different malware chains (AMOS for macOS or NetSupport Manager for Windows) based on their operating system. It leverages the "ClickFix" lure, which prompts users to manually copy-paste malicious commands into their terminal or PowerShell under the guise of fixing a document rendering error.
## Technical Details
- **Type:** Malware Delivery Technique / Triage Script
- **Platform:** macOS, Windows
- **Capabilities:** OS Fingerprinting, Geolocation tracking, Crypto-wallet scanning (MetaMask, Phantom, Tron, Solana), Telegram-based exfiltration, and Platform-specific payload delivery.
- **First Seen:** Variant observed August/September 2024 (Campaign activity dating back to October 2023).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1059.006 - Command and Scripting Interpreter: Python]
- [T1204.002 - User Execution: Malicious File]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- [T1614 - System Location Discovery]
- **[TA0010 - Exfiltration]**
- [T1567 - Exfiltration Over Web Service]
## Functionality
### Core Capabilities
- **Environmental Triage:** The Google Apps Script executes client-side to detect the user's public IP, physical location, and operating system.
- **Crypto-Scanning:** Scans the browser environment for specific cryptocurrency wallet extensions (MetaMask, Phantom, Tron, Solana).
- **C2 Communication:** Uses the Telegram API to send "action codes" and heartbeat beacons to the threat actor, providing real-time telemetry on potential victims.
- **Social Engineering (ClickFix):** Displays a fake "Decryption Failure" message to trick users into executing manual commands.
### Advanced Features
- **Platform-Specific Routing:**
- **macOS:** Delivers **AMOS (Atomic macOS Stealer)** via a `.dmg` or terminal command instructions.
- **Windows:** Initiates a **PowerShell loader chain** that ultimately installs **NetSupport Manager** (a legitimate remote administration tool used maliciously).
- **Native Trust Exploitation:** By using `script.google.com`, the attack bypasses traditional domain reputation filters and avoids OAuth consent prompts since the script runs within the context of the document sidebar.
## Indicators of Compromise
- **File Names:** `Atomic.dmg` (Common for AMOS), `Document_Fix.ps1` (Example PowerShell loader).
- **Network Indicators:**
- `api.telegram[.]org` (Exfiltration and heartbeats)
- `script.google[.]com` (Script hosting)
- `coin-desk[.]top` (Example malicious landing domain - defanged)
- **Behavioral Indicators:**
- Users copying content from a Google Doc sidebar and immediately pasting into Terminal/PowerShell.
- Unexpected outbound connections to Telegram API from browser processes or PowerShell.
- Execution of `curl` or `wget` commands targeting DMG or PS1 files from unconventional domains.
## Associated Threat Actors
- **BlueNoroff** (DPRK-linked): Known for sophisticated crypto-theft and macOS targeting.
- **General Cybercrime Actors:** Utilizing "ClickFix" templates as a service.
## Detection Methods
- **Behavioral Detection:** Monitor for PowerShell or Terminal processes spawned with high-entropy command lines involving `IEX` (Invoke-Expression) or `curl | sh`.
- **Network Monitoring:** Alert on high-frequency or suspicious POST requests to Telegram API endpoints from non-chat applications.
- **Endpoint Inspection:** Use EDR to flag the creation of unexpected hidden directories in `/Users/Shared/` (macOS) or `AppData\Roaming` (Windows) associated with remote access tools.
## Mitigation Strategies
- **User Education:** Train staff to never copy-paste commands from a web browser directly into a terminal or command prompt.
- **Browser Security:** Implement strict Content Security Policies (CSP) and consider disabling or restricting Google Apps Script execution if not required for business.
- **Application Whitelisting:** Prevent the execution of unauthorized remote management tools like NetSupport Manager unless explicitly approved.
## Related Tools/Techniques
- **AMOS (Atomic macOS Stealer):** The payload for Mac users.
- **NetSupport Manager:** The RAT payload for Windows users.
- **ClearFake / ClickFix:** The broader family of social engineering templates using fake "Update" or "Fix" overlays.