AMOS Stealer + XMRig macOS ClickFix Crimekit: EtherHiding C2 on Polygon Blockchain — OTX Detection Pack

---
title: macOS ClickFix Malicious AppleScript Execution via Terminal
id: 9f2a1b7e-3c4d-4e5f-8a6b-1d2c3e4f5a01
status: production
description: Detects ClickFix-style social engineering where users are tricked into pasting malicious osascript commands into Terminal, as used by the AMOS/XMRig EtherHiding crimekit
author: Security Arsenal Threat Intel
references:
    - https://notes.netbytesec.com/2026/08/anatomy-of-macos-clickfix-crimekit-that.html
date: 2026/08/26
modified: 2026/08/26
tags:
    - attack.execution
    - attack.t1059.002
    - attack.t1204
logsource:
    category: process_creation
    product: macos
detection:
    selection_process:
        Image|endswith:
            - '/osascript'
            - '/bash'
            - '/zsh'
    selection_flags:
        CommandLine|contains:
            - 'osascript -e'
    selection_suspicious:
        CommandLine|contains:
            - 'base64'
            - 'curl'
            - 'do shell script'
            - 'eval'
            - ' | sh'
            - ' | bash'
    condition: selection_process and (selection_flags or selection_suspicious)
falsepositives:
    - Legitimate MDM enrollment scripts and IT automation
level: high
---
title: macOS LaunchAgent Persistence Creation for Backdoor Agent
id: 9f2a1b7e-3c4d-4e5f-8a6b-1d2c3e4f5a02
status: production
description: Detects creation of suspicious LaunchAgent plist files, the persistence mechanism used by the AMOS/EtherHiding macOS backdoor agent
author: Security Arsenal Threat Intel
references:
    - https://notes.netbytesec.com/2026/08/anatomy-of-macos-clickfix-crimekit-that.html
date: 2026/08/26
modified: 2026/08/26
tags:
    - attack.persistence
    - attack.t1543.001
logsource:
    category: file_event
    product: macos
detection:
    selection_path:
        TargetFilename|contains:
            - '/Library/LaunchAgents/'
            - '~/Library/LaunchAgents/'
    selection_ext:
        TargetFilename|endswith: '.plist'
    filter_known:
        TargetFilename|contains:
            - 'com.apple.'
            - 'com.google.'
            - 'com.microsoft.'
    condition: selection_path and selection_ext and not filter_known
falsepositives:
    - Legitimate third-party software installers (investigate signing and parent process)
level: medium
---
title: EtherHiding Polygon RPC Query from Non-Browser Process
id: 9f2a1b7e-3c4d-4e5f-8a6b-1d2c3e4f5a03
status: production
description: Detects outbound connections to Polygon blockchain RPC endpoints from non-browser processes, consistent with EtherHiding C2 address resolution via smart contract reads
author: Security Arsenal Threat Intel
references:
    - https://notes.netbytesec.com/2026/08/anatomy-of-macos-clickfix-crimekit-that.html
date: 2026/08/26
modified: 2026/08/26
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1027
logsource:
    category: network_connection
    product: macos
detection:
    selection_dest:
        DestinationHostname|contains:
            - 'polygon-rpc.com'
            - 'rpc-mainnet.matic'
            - 'polygon-mainnet'
            - 'matic-mainnet'
            - 'polygon.llamarpc.com'
            - 'polygon.drpc.org'
    filter_browsers:
        Image|endswith:
            - '/Safari'
            - '/Google Chrome'
            - '/firefox'
            - '/Brave Browser'
            - '/Arc'
    condition: selection_dest and not filter_browsers
falsepositives:
    - Legitimate Web3 wallet daemons, crypto trading tools, development activity (hardhat/foundry)
level: high

// Hunt: AMOS/XMRig ClickFix crimekit - lure domains, osascript abuse, and EtherHiding RPC lookups
// Microsoft Sentinel | Time range: last 30 days
let ClickFixIOCs = dynamic(["citcix6.xyz","sj98xe4.xyz","hf98x4d.site","xuiaxwx.com","gesck4m.pro","apdhlhs3.xyz","okekjaiw.click","8jdjpwka.baby"]);
let PolygonRPC = dynamic(["polygon-rpc.com","rpc-mainnet.matic.network","rpc-mainnet.maticvigil.com","polygon.llamarpc.com","polygon.drpc.org","polygon-mainnet.g.alchemy.com","polygon-mainnet.infura.io"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where RemoteUrl has_any (ClickFixIOCs)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
    | extend HuntHit = "ClickFix Lure Domain"),
    (DeviceNetworkEvents
    | where RemoteUrl has_any (PolygonRPC)
    | where not(InitiatingProcessFileName has_any ("Safari","chrome","firefox","brave","Arc","MicrosoftEdge"))
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
    | extend HuntHit = "EtherHiding Polygon RPC from Non-Browser"),
    (DeviceProcessEvents
    | where FileName =~ "osascript"
    | where ProcessCommandLine has_any ("base64","curl","do shell script","eval")
    | where InitiatingProcessFileName has_any ("Terminal","iTerm2","zsh","bash")
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
    | extend HuntHit = "Suspicious osascript from Terminal (ClickFix Pattern)"),
    (DeviceProcessEvents
    | where ProcessCommandLine has_any ("xmrig","stratum+tcp","--donate-level","--coin=monero")
       or FileName has_any ("xmrig")
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath
    | extend HuntHit = "XMRig Cryptominer Execution")
| order by Timestamp desc

#!/bin/bash
# macOS Hunt Script: AMOS Stealer / XMRig / EtherHiding ClickFix Crimekit
# Run via MDM (Jamf, Kandji) or manually across Mac fleet. Requires sudo for full coverage.

echo "=== [1] Checking LaunchAgents/LaunchDaemons for suspicious persistence ==="
for dir in ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons; do
    if [ -d "$dir" ]; then
        echo "--- $dir ---"
        # Flag non-Apple plists modified in the last 90 days
        find "$dir" -name "*.plist" -mtime -90 2>/dev/null | while read plist; do
            if ! grep -qi "apple\|google\|microsoft\|jamf\|adobe" "$plist" 2>/dev/null; then
                echo "[SUSPICIOUS] $plist"
                /usr/libexec/PlistBuddy -c "Print :ProgramArguments" "$plist" 2>/dev/null
                /usr/libexec/PlistBuddy -c "Print :RunAtLoad" "$plist" 2>/dev/null
            fi
        done
    fi
done

echo "=== [2] Checking for XMRig and suspicious miner processes ==="
ps aux | grep -iE "xmrig|stratum|monero|cryptonight" | grep -v grep
ps aux | awk '$3 > 80.0 {print "[HIGH CPU]", $0}'

echo "=== [3] Hunting ClickFix IOC domains in DNS caches and logs ==="
IOCS="citcix6.xyz sj98xe4.xyz hf98x4d.site xuiaxwx.com gesck4m.pro apdhlhs3.xyz okekjaiw.click 8jdjpwka.baby"
for ioc in $IOCS; do
    dscacheutil -cachedump -entries host 2>/dev/null | grep -i "$ioc" && echo "[HIT - DNS CACHE] $ioc"
    log show --last 30d --predicate 'process == "mDNSResponder"' 2>/dev/null | grep -i "$ioc" && echo "[HIT - LOG] $ioc"
done

echo "=== [4] Checking for EtherHiding - active connections to Polygon RPC endpoints ==="
lsof -i -nP 2>/dev/null | grep -iE "polygon-rpc|matic|maticvigil|llamarpc|drpc" | grep -v -iE "safari|chrome|firefox|brave"
netstat -anv 2>/dev/null | grep ESTABLISHED | awk '{print $5}' | sort -u

echo "=== [5] Checking for AMOS artifacts - Keychain access prompts and staged exfil ==="
ls -la /tmp/ 2>/dev/null | grep -iE "\.zip|\.tar|out|dump|loot" 
find ~/Library/Application\ Support -maxdepth 2 -name "*.log" -mtime -30 -newer /var/db/.AppleSetupDone 2>/dev/null | head -20
log show --last 7d --predicate 'eventMessage CONTAINS "securityd"' 2>/dev/null | grep -iE "deny|prompt" | tail -20

echo "=== [6] Shell history check for pasted osascript/curl ClickFix commands ==="
for histfile in ~/.zsh_history ~/.bash_history; do
    if [ -f "$histfile" ]; then
        grep -iE "osascript -e|base64.*\| *(sh|bash)|curl.*\| *(sh|bash)" "$histfile" 2>/dev/null && echo "[HIT - HISTORY] $histfile"
    fi
done

echo "=== Hunt complete. Review [SUSPICIOUS] and [HIT] entries. ==="