Download gate verification

Malwarebytes published this on 24 August 2026, following a multi-stage loader it calls PavinLoader from the RenPy fake-game campaigns it had analysed earlier into other operations: ClickFix pages, including a Cloudflare-themed one whose PowerShell fetches an installer from a cloud storage bucket, and fake software downloads served from Dropbox. The routes then converge. Legitimate MSBuild runs project or batch files that load trojanised copies of real .NET libraries, the loader reads its C2 domain from a BNB Smart Chain contract, and later stages arrive as XOR-encoded JSON. It checks for virtual machines and compares the keyboard languages and region against Russian and neighbouring locales. In the chain Malwarebytes followed, the payload was Amatera Stealer. Builder artefacts hint, unconfirmed, that it is sold as a service. The indicator list covers the loader across all these campaigns, not the ClickFix route alone.

Hudson Rock published this account on 14 September 2026, researched with ADAMnetworks, and names the operation PasteSwitch. It came to light when the verified HBO Max account on Reddit, taken over, ran 108 adverts in about two days for a Mac HBO Max app that does not exist, AI coding tools and disk cleaners. Each landing page offered a command to paste instead of a file. Behind the lures a gate sorts visitors by platform: Mac users get curl-to-zsh commands delivering MacSync, a persistent AMOS helper that takes further tasks, or counterfeit Ledger, Trezor and Exodus wallets; Windows users get an mshta route that loads Amatera Stealer in memory. Its cryptocurrency clippers read their C2 from BNB Smart Chain contracts, one of them the contract Cisco Talos analysed in a separate ClearFake chain. Several helper hosts also appear in Microsoft's May 2026 reporting.

Datadog Security Labs described this operation on 10 February 2026 and assessed it as ongoing. GitHub repositories posing as desktop software from technology firms — one advertised a Datadog desktop application that does not exist — held only a README whose download link began a redirect chain. A GitHub Pages site styled after GitHub itself profiled each visitor, posted the fingerprint to a Google Apps Script address, and sorted traffic: macOS visitors reached a ClickFix page, Windows a ZIP download, others a genuine pricing page. The ClickFix page had the visitor paste a Terminal command that pulled a shell script and executed it. Earlier variants installed MacSync, formerly Mac.c, which swapped resources of installed wallet applications; later ones delivered SHub Stealer v2.0, which validates the phished password, gathers documents, browser and wallet data, and persists as a counterfeit Google updater beaconing for commands. Datadog reported the repositories to GitHub.

Sekoia grouped a large set of counterfeit download sites with the fake Google Meet pages it was tracking, on registration records, passive DNS, and page construction that repeats across the estate. The brands are borrowed or invented outright: video conferencing, document utilities, several games that do not exist, Web3 browsers and messengers, a metaverse client. Every page runs the same script — the visitor is told a check has failed, then walked through pasting a command. Windows visitors were sent Stealc or Rhadamanthys; macOS visitors were sent AMOS. Distribution ran through affiliate crews rather than one operator, which is why the naming conventions wander while the page templates do not. We hold this as a single estate because that is how the source groups it; the individual lure themes are tagged separately below.

Proofpoint ties this chain to TA427, the North Korean group others track as Kimsuky and Emerald Sleet. Operators approached staff at a handful of think tanks working on North Korean affairs with a spoofed meeting invitation, built rapport, then sent a PDF whose link pointed at a dynamic-DNS host dressed up as a corporate file store. Trying to open the decoy document raised a registration pop-up that handed the reader a licence-style code hiding a PowerShell instruction to paste into a terminal. Running it fetched a second script, showed a Japanese foreign-ministry questionnaire as cover, and set scheduled tasks that ran a VBS stager every nineteen minutes. One January 2025 instance went further: batch files decoded a Base64 and XOR-wrapped QuasarRAT that reached its controller over port 80. Delivery names sat on FreeDNS and No-IP services, largely on hacked South Korean servers.

Microsoft Threat Intelligence tracked a cluster of more than 250 look-alike download domains distributing macOS information stealers, among them MacSync and Atomic Stealer. Many names come from a generator pairing the token "file" with two dictionary words, across .com, .sbs and .online, though some place it elsewhere or omit it. Early pages handed the paste-into-Terminal instruction to any visitor; the operators later put a small JavaScript profiler in front, reading navigator, screen and WebGL values, timezone, iframe and touch state, plus tripwires for an open developer console and hooked prototypes, then posting the result back for a server-side ruling. Requests that fail receive a blank shell, a bogus VPN-extension page or an unrelated business site, so a benign answer proves little. Those that pass see a forged Verified Publisher badge, spoofed GitHub styling and a one-click Terminal command ending in Atomic Stealer.

OBSCURE#BAT is the name Securonix gave to activity that installs an altered build of r77, an open-source rootkit whose value to an operator is staying hidden and staying put. Microsoft attributes one of the lure pages it pulls apart in this write-up to that same cluster. The page presents itself as a Discord server that wants a visitor identified before letting them join, and borrows the platform's own logo to sell the idea. Its script waits for the verify button and then uses the browser's clipboard interface to load a command, with no hidden frame and no message from another document involved — plainer than the other example Microsoft dissects, where a concealed frame signals the parent page. Recorded alongside it are a landing page, a batch file on a public file host, and two addresses used for control between February and March 2025.