macOS disk-cleanup lure sites

Summary

Microsoft Threat Intelligence tracks macOS users being steered towards fake troubleshooting advice — disk-cleanup tips, cleaner utilities — published on standalone sites and on note-taking and blogging services. Each page carries an encoded blob the reader is told to paste into Terminal, which fetches and runs a script instead of installing anything. Three execution paths are separated in the report; all end in an infostealer that takes Keychain items, browser credentials, iCloud data, documents and wallet files, and two of them swap installed wallet applications for tampered copies. Because scripts launched from a shell are not put through the checks an application bundle would face, the operator gets execution without notarisation. This entry holds the lure sites and the hosts and file hashes the report leaves at the level of the operation rather than assigning to one path. Apple has since added a paste warning to Terminal.

Execution mechanisms

The only execution mechanism any published account describes for this campaign is Terminal paste (macOS) (T1059.004), which 8 of the 44 published campaigns in this corpus also record (18%).

Indicators

15 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.