MacOS ClickFix Campaign Abuses Polygon Smart Contracts for Stealthy Persistence

A new macOS-focused ClickFix campaign has been discovered to be using Polygon smart contracts to conceal its command-and-control infrastructure. The operation combines fake CAPTCHA social engineering with EtherHiding, making it difficult for defenders to track and disrupt.

The malware uses a Cloudflare Worker to retrieve a payload from the internet, bypassing traditional download-and-double-click mechanisms used by macOS to alert users of untrusted software. Once executed, the malware launches an AppleScript through the legitimate osascript utility, which decodes layers that install a LaunchAgent for persistence and an AppleScript loader.

The loader does not embed a C2 domain but instead sends read-only eth_call requests to public Polygon RPC services to retrieve the C2 hostname from a specific smart contract. This technique is known as EtherHiding, where attacker-controlled configuration is stored in public blockchain state and fetched only at runtime.