Campaign record
Telegram fallback C2 on macOS
macOS ClickFix script install chain with Telegram fallback C2
- Status as last assessed
- Active
- First seen
- 2026-04-01
- Last seen
- 2026-05-06
- Indicators
- 17
- Sources
- 1
- Targets
- macOS
- Fake macOS utility or troubleshooting guide
Original research
- Microsoft Threat Intelligence2026-05-06Vendor researchFirst account
ClickFix campaign uses fake macOS utilities lures to deliver infostealers
This page summarises and structures that research; it is not a substitute for the original.
Researchers: if anything here misrepresents your work, email corrections@clickfixreport.com — we correct within 5 working days, no questions asked.
Summary
The second execution path, seen from April 2026. An encoded instruction pasted into Terminal resolved to a one-line pipeline that streamed a remote shell script straight into the interpreter, leaving nothing recognisable on disk. That script set up persistence through a LaunchAgent plist holding an encoded AppleScript stage, obfuscated by character-code concatenation. Decoded, the stage works as a locator: it walks a built-in list of server names, probes each with a short POST and a browser user agent, and if none answer it pulls a Telegram bot's public page and lifts a replacement server name out of the markup. Whichever server responds is then asked for the next stage, which is piped into osascript and run in memory. Archived data left over a POST to an upload endpoint. If every check fails the script simply stops, which is its only exit condition.
Execution mechanisms
The only execution mechanism any published account describes for this campaign is Terminal paste (macOS) (T1059.004), which 8 of the 44 published campaigns in this corpus also record (18%).
Indicators
17 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.
| Indicator | Type | Role | Assessment | Report an error |
|---|---|---|---|---|
| domain, shown defanged for safety: domenpozh dot net | domain | Lure page | Attacker-controlled | Report an error in domain record 19fe5cce-c770-4f73-8a19-9b919448bd55 |
| url, shown defanged for safety: hxxp colon slash slash paralegalmustang dot icu/script dot sh | url | Download URL | Attacker-controlled | Report an error in url record a4ba0422-0108-4ff5-b6a8-c2a6670ca765 |
| url, shown defanged for safety: hxxps colon slash slash cauterizespray dot icu/script dot sh | url | Download URL | Attacker-controlled | Report an error in url record 1d499936-8dae-4f1c-ae0a-db800fd153bb |
| url, shown defanged for safety: hxxps colon slash slash enslaveculprit dot digital/script dot sh | url | Download URL | Attacker-controlled | Report an error in url record d6da95f6-cee8-433b-9ffd-434ffe8ca932 |
| url, shown defanged for safety: hxxps colon slash slash kvrnjr30 dot apexharvestor dot digital/ | url | Download URL | Attacker-controlled | Report an error in url record b83d0814-d0b6-49fc-8efa-fea973438e87 |
| url, shown defanged for safety: hxxps colon slash slash qjywvkbl dot degassing-mould dot digital/ | url | Download URL | Attacker-controlled | Report an error in url record 7de1f8bf-da9f-4c52-8840-524135b3ceb2 |
| url, shown defanged for safety: hxxps colon slash slash resilientlimb dot icu/script dot sh | url | Download URL | Attacker-controlled | Report an error in url record a6fe87cb-889a-4df7-82bc-7df7bc5cabca |
| url, shown defanged for safety: hxxps colon slash slash round5on dot digital/script dot sh | url | Download URL | Attacker-controlled | Report an error in url record 95349e33-187c-40df-8de9-64a1683b75e4 |
| url, shown defanged for safety: hxxps colon slash slash thickentributary dot digital/script dot sh | url | Download URL | Attacker-controlled | Report an error in url record 8a2f075b-1e72-41d9-96e0-70eba1e08ebb |
| url, shown defanged for safety: hxxps colon slash slash yygp4pdh dot apexharvestor dot digital/ | url | Download URL | Attacker-controlled | Report an error in url record 297f15e3-8212-4439-8a7f-9c068acf904b |
| url, shown defanged for safety: hxxps colon slash slash zg5mkr7q dot apexharvestor dot digital/ | url | Download URL | Attacker-controlled | Report an error in url record 8074413c-3b06-49b9-8ce6-6fb8a9edf0c1 |
| domain, shown defanged for safety: 0x666 dot info | domain | Command and control | Attacker-controlled | Report an error in domain record b1b74ee2-64ea-4b13-8c30-921ee5594d50 |
| domain, shown defanged for safety: honestly dot ink | domain | Command and control | Attacker-controlled | Report an error in domain record b12cefb2-8034-44d5-87d0-a10a438945dc |
| domain, shown defanged for safety: pla7ina dot cfd | domain | Command and control | Attacker-controlled | Report an error in domain record 5335ff88-5450-4e06-8c35-bde83d023496 |
| domain, shown defanged for safety: play67 dot cc | domain | Command and control | Attacker-controlled | Report an error in domain record 1fa8c21a-40ed-4dee-b68d-7cf3bd90e571 |
| ip, shown defanged for safety: 95 dot 85 dot 251 dot 177 | ip | Command and control | Not yet assessed | Report an error in ip record 459bb335-becd-4d4a-89d1-009c2ca4f3db |
| url, shown defanged for safety: hxxps colon slash slash t dot me/ax03bot | url | Command and control | Shared platform | Report an error in url record ab918761-ce08-44b3-9f6c-5197f2af7a4e |
“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.
Not on this record
This record does not yet carry a second publisher's account, any overlap with another campaign in this corpus or our own re-checks of these indicators. Each appears on this page as its own section once it exists; none of it is inferred.
Cite as
ClickFixReport, “Telegram fallback C2 on macOS”, campaign ID 5e799560, retrieved 2026-08-07, snapshot fb0eed7.
https://clickfixreport.com/campaigns/5e799560/macos-clickfix-script-install
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.