Matryoshka ClickFix macOS Variant — Nested Heredoc Obfuscation, AppleScript Credential Stealer, Trezor Suite Replacement, Ledger Live Surgical Patching, API-Gated C2
Matryoshka ClickFix macOS Variant (TL-2026-0120) is a high-severity phishing campaign, first published 2026-02-16. It is attributed to Lazarus Group (North Korea) with low confidence, maps to 24 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 12 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0120
- Threat ID
- TL-2026-0120
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-02-16
- Last reviewed
- 2026-02-16
- Attribution
- Lazarus Group
- Attribution confidence
- LOW
- Nation-state nexus
- North Korea
- Motivation
- financial
- Target sectors
- cryptocurrency, financial-services, technology
- Target regions
- Global
- Detection rules
- 12
- Indicators of compromise
- 24
Matryoshka is a macOS-specific ClickFix social engineering variant that uses nested obfuscation (like Russian nesting dolls) to deliver a credential-stealing and crypto wallet-hijacking payload. The attack chain: typosquatted domain (comparisions[.]org) → Traffic Distribution System redirect → fake 'paste this fix' prompt → victim pastes Terminal command → heredoc-encoded shell script → in-memory Base64+gunzip decode → API-gated C2 → AppleScript stealer targeting browser credentials, Trezor Suite, and Ledger Live. The stealer uses fake macOS 'System Preferences' dialogs for password phishing and surgically patches Ledger Live's Electron archive (app.asar) + re-signs the bundle. Discovered by Intego Antivirus Labs, February 2026.
How Matryoshka ClickFix macOS Variant works
Matryoshka is a sophisticated evolution of the ClickFix social engineering paradigm specifically targeting macOS users. Named after Russian nesting dolls (матрёшка) due to its nested obfuscation layers, this variant represents the first documented ClickFix campaign designed specifically for the macOS Terminal and AppleScript ecosystem.
**INFECTION VECTOR — TYPOSQUATTING + TDS:** The attack begins when users mistype a legitimate URL. Intego observed comparisions[.]org (note extra 'i') mimicking comparisons.org (software review site). The typosquatted domain immediately redirects through a Traffic Distribution System (TDS) to a page presenting fake installation/fix instructions. Users are told to copy a command and paste it into their macOS Terminal.
Why this works: By pasting into Terminal, the user authorizes execution. This sidesteps macOS Gatekeeper, notarization checks, and download-and-launch security expectations that protect against traditional malware delivery.
**STAGE 0 — CLIPBOARD INJECTION:** The pasted command retrieves a shell script from barbermoo[.]xyz containing a large encoded payload. The command appears benign: 'Installing packages please wait...' followed by a curl command piped to zsh.
**STAGE 1 — MATRYOSHKA WRAPPER (In-Memory Decode):** The fetched script (rogue.sh) uses a heredoc structure to pass the payload through an in-memory pipeline: Base64 decode → gunzip → eval. The meaningful payload is nested inside an encoded/compressed blob and only becomes readable at runtime. No clean script file is written to disk — reducing visibility for file-based scanning and complicating static analysis. This is the core innovation giving the variant its name.
**STAGE 2 — API-GATED LOADER:** The expanded loader implements sophisticated evasion: 1. Background detachment: Main routine runs in background, exits quickly. Terminal prompt returns immediately — victim believes the process finished. 2. Output suppression: stdin/stdout/stderr redirected to /dev/null — no visible artifacts in Terminal. 3. API-gated communication: Requests require a specific custom header (api-key: 5190ef17...) to receive meaningful C2 responses. Without the header, infrastructure returns generic errors or appears inactive — frustrates automated sandboxes. 4. Conditional forwarding: Script checks for arguments and can pass harvested data between stages.
**PAYLOAD — APPLESCRIPT STEALER:** The C2 delivers an AppleScript payload (detected as trojan:AppleScript/Stealer.gen) with three capabilities:
A) PASSWORD CAPTURE VIA PHISHING LOOP: First attempts programmatic credential theft. If unsuccessful, falls back to an interactive phishing loop: fake macOS 'System Preferences' dialog branded as 'Required Application Helper' repeatedly prompts for password with hidden input. The dialog loops until the victim complies — there is no 'cancel' escape that stops the malware.
B) CRYPTO WALLET TARGETING: - Trezor Suite: Delete and replace — terminates process, removes legitimate app, downloads malicious replacement. - Ledger Live: Surgical patching — replaces the Electron app.asar archive and metadata within the legitimate application bundle, then performs local ad-hoc re-signing (codesign -f -s -) to reduce integrity warnings. This is more subtle than full replacement — the app appears legitimate but the core logic is replaced.
C) EXFILTRATION + DECEPTION: Collected data (browser credentials, wallet artifacts) staged to /tmp/osalogging.zip. Loader uploads via POST to C2 /gate endpoint. After exfiltration, displays fake error: 'Your Mac does not support this application' to misdirect victim and delay investigation.
**EVASION ANALYSIS:** - In-memory only: Payload decoded and decompressed in memory, no disk artifacts for the obfuscated stages. - API-gated C2: Custom header requirement defeats automated sandbox analysis. - Quick Terminal return: Background detachment makes victim believe process completed normally. - Output suppression: No Terminal output visible to user. - Wallet re-signing: Ad-hoc codesign of tampered Ledger Live reduces macOS integrity warnings. - Final deception: Fake error message provides cover story for the Terminal activity.
MITRE ATT&CK techniques used in TL-2026-0120
collection
T1005 Data from Local System; T1056.002 GUI Input Capture; T1115 Clipboard Data; T1560.001 Archive via Utility
defense-evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1564.003 Hidden Window
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.001 Malicious Link
command-and-control
discovery
T1082 System Information Discovery
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools
credential-access
T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers
impact
T1565.001 Stored Data Manipulation
initial-access
resource-development
Remediation for Matryoshka ClickFix macOS Variant
Patches
- N/A — no software vulnerability; social engineering + crypto wallet theft
Immediate actions
- NEVER paste commands from websites into macOS Terminal — no legitimate software update requires this
- CHECK CRYPTO WALLETS: If you recently pasted any Terminal command from a website, immediately verify Trezor Suite and Ledger Live integrity (reinstall from official sources)
- BLOCK typosquatting domains: comparisions[.]org, barbermoo[.]xyz, macfilesendstream[.]com
- CHECK for staging files: look for /tmp/osalogging.zip on any potentially compromised Mac
- ROTATE CREDENTIALS: If compromised, rotate all browser-saved passwords and crypto wallet recovery phrases immediately
Workarounds
- Use DNS-over-HTTPS with typosquatting protection
- Enable macOS Lockdown Mode for high-risk users (restricts some Terminal functionality)
- Store cryptocurrency recovery phrases OFFLINE — never accessible from any computer
Longer-term hardening
- USER AWARENESS: Train all macOS users that legitimate software NEVER requires pasting commands into Terminal
- DNS FILTERING: Deploy DNS-based typosquatting detection for corporate domains and commonly visited sites
- ENDPOINT DETECTION: Deploy macOS EDR that monitors Terminal-initiated fetch-and-execute patterns and osascript execution
- WALLET INTEGRITY: Use hardware wallet companion app integrity verification (check code signatures, compare hashes against official releases)
- APPLICATION ALLOWLISTING: Use macOS MDM to restrict application installation and modification to authorized sources
Timeline of Matryoshka ClickFix macOS Variant
- ClickFix social engineering technique emerges, primarily targeting Windows users with fake CAPTCHAs and copy-paste PowerShell commands. macOS variants are rare at this stage.
- Intego documents fake Arc Browser campaign using AppleScript stealer component. Establishes AppleScript as a viable macOS malware delivery mechanism for credential theft. Source: Intego Mac Security Blog.
- ClickFix campaigns add instruction videos specifically targeting macOS users, showing Terminal paste technique. macOS becomes a documented ClickFix target platform.
- Matryoshka ClickFix campaign observed active in the wild. Typosquatted domain comparisions[.]org redirecting macOS users through TDS to fake fix prompts.
- Intego Antivirus Labs publishes detailed technical analysis of Matryoshka variant: nested obfuscation (heredoc + Base64 + gunzip + eval), API-gated C2, AppleScript credential stealer, Trezor Suite deletion/replacement, Ledger Live surgical patching. Source: https://www.intego.com/mac-security-blog/matryoshka-clickfix-macos-stealer/
- Cyber Security News publishes coverage of Matryoshka campaign, reaching broader security community. Confirms Intego findings and highlights crypto wallet targeting. Source: https://cybersecuritynews.com/new-clickfix-variant-matryoshka-attacking-users/
- As of 2026-05-29, TL-2026-0120 (Matryoshka macOS ClickFix) stays ACTIVE: no CVE/patch exists for this social-engineering crypto-stealer, no infra takedown is reported, and the macOS ClickFix wave is escalating. Apple's macOS Tahoe 26.4 Terminal paste warning was already bypassed via the applescript:// Script Editor trick (Jamf, Apr 2026), with May 2026 successors (SHub, MacSync).
Sources cited for Matryoshka ClickFix macOS Variant
Threats related to Matryoshka ClickFix macOS Variant
Detection coverage for TL-2026-0120
As of 2026-02-16, Threadlinqs Intelligence publishes 12 detection rule(s) for TL-2026-0120 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.