ClickFix Campaign Exploits Polygon Smart Contracts for Mac Malware Deployment

A new macOS-focused ClickFix campaign is using Polygon smart contracts to deploy an Atomic macOS Stealer (AMOS) variant, a persistent backdoor, and an XMRig cryptominer. The operation combines fake CAPTCHA social engineering with EtherHiding, making infrastructure rotation far more resilient than traditional hardcoded C2 schemes.

The command decodes to a curl | bash pipeline that retrieves a payload from a Cloudflare Worker and executes it without a conventional downloaded application. This bypasses the familiar download-and-double-click flow that macOS users associate with untrusted software warnings.

The Worker returns an obfuscated AppleScript launched through the legitimate macOS utility osascript, which writes a LaunchAgent for persistence and installs an AppleScript loader designed to evade static inspection.