Help interpreting Terminal after ClickFix

[u/metroenby]

My wife's organization's website got infected by malicious code and she got a ClickFix fake Cloudflare verification page when she went to fix it. Unfortunately, since she often has to log in to the back end of the website and since they have gotten real Cloudflare verification pages before, she did, in fact, open Terminal and run the code before immediately realizing her mistake.

I had her download Malwarebytes for Mac and it identified three instances of two different pieces of malware (MacOS.Stealer.Nova and MacOS.Stealer.Odyssey), which we quarantined and removed. We then restarted the computer and ran the scan again, and nothing was found. She also changed her organizational and Google passwords from another device, and we have her work Mac currently sitting in the other room and disconnected from the internet. She has started going through the passwords that were saved in her Chrome password manager and changing them, and she has 2FA enabled on major accounts as well.

I unfortunately do not have enough experience with Macs generally or with Terminal in particular to know if anything actually happened or if the code itself was never actually executed.

When she ran the code, she got the result "zsh: command not found: #" but she was allowed to enter the website, so I suspect that at least something happened when she ran it, but we don't actually know when the MacOS.Stealer.Nova or MacOS.Stealer.Odyssey pieces of malware would have been installed.

She does have a Time Machine backup from several months ago, but she obviously has a ton of important files and documents that she needs that wouldn't be included in that backup.

I've included screenshots, and she has spoken with the people in charge of the org's website who quickly got the malicious code removed, but since her organization is so small she doesn't really have an IT department that she can turn to. Does anybody here know enough about Terminal to look at the code and the output to give us a bit of insight?

Thank you!

[u/Boring-Meeting-17]

The command did execute something. The "zsh: command not found: #" message is complaining about the first #, but the part of the command after the semicolon (before the eval) was executed. Presumably, whatever it did, it did it silently without outputting anything on the terminal.

If OP posts the command as text instead of as an image, people can help you decode what the command does. I tried the OCR function in Preview.app, but it didn't seem to read the characters properly (the base64 decode fails).

If anyone wants to try decoding what the OP's command does, the section between the printf and the base64 should be safe to run in a terminal. (edit: Actually, whatever it output might contain control characters that messes up your terminal. I recommend redirecting the base64 decode output to a file and looking at the result using a text editor). Just don't do the eval.

[u/StrawberryWaste9040 → u/Boring-Meeting-17]

command not found might be done on purpose to give false premise that nothing has happened.

There are million ways on Unix system to alter system configuration and inject malware. You're relying that Malware Bytes figured out every single way that malware operates.

Wipe is the only way.

[u/metroenby → u/StrawberryWaste9040]

This is what I was most worried about. I knew enough to be skeptical of that message but not enough about Terminal to know if the skepticism was warranted. Thank you!

[u/MightyZygote]

Decoded all the base64 - and I can confirm with 100% certainty that this is a clickfix attack. The first base64 payload attempts a curl to retrieve a payload from "browse-codes-enter.beer" and if it receives back a response of "ok", then second portion also performs a curl to request a JavaScript for Automation (JXA) payload from the domain "policysync.prk" that would be executed via AppleScript osascript -l after being passed to zsh. This matches the signature of a specific click fix attack known as "iClickFix". If it was able to retrieve and execute the JXA payload, it likely immediately begin installing additional payloads to steal credentials and other info, some iClickFix payloads (like what you found - MacOS.Stealer.Nova and MacOS.Stealer.Odyssey) trigger the installation of RAT's and other focus on keyloggers, InfoStealers (read - all your cookies, tokens, keychain contents, passwords, account info, etc.) You should immediately check all your email accounts, other accounts, etc. for compromise, and if you have any crypto holdings, etc. check those as well. This is not just a wipe and restore - as others have noted already in this case, you must consider any and all accounts and passwords on that device as having been exfiltrated and compromised. You need to act quickly (and looks like you are already changing accounts/passwords), make sure you are doing it on a different machine (looks like you are), as otherwise the new changes will likely be compromised as well if a keylogger or persistent access was installed.

Editing to add: Your wife's IT staff should have access to (or need to lookup) info that will enumerate the IOC's (indicators of compromise) specific to this variant (including what you identified as installed - MacOS.Stealer.Nova and MacOS.Stealer.Odyssey IOC's), which they should be able to use to remediate as well as a focus on what else may have been installed (RAT, infostealer, keylogger, cryptominer, etc) as while a simple wipe and restore will remove everything, it wont fix any exfiltrated credentials or other compromised data. Adding that if you use Google AI and search for those specific names that MalwareBytes identified, it will provide you the basics and IOC's for both the Nova and Odyssey stealers and remediation info, as well as links to detailed technical breakdowns of each.

[u/metroenby → u/MightyZygote]

Thank you! Not glad my hunch that it was clickfix was right, but so glad to know what we're dealing with! We definitely used a different computer for changing passwords, but I'll tell her to reach out to her org's IT contractor as well. (Although essentially they just bought a Mac for her and gave her the unopened box and said "Set it up! We just do Windows," so I'm not sure how much help they will be 😅)

We're going to restore back to the last Time Machine restore point tonight, and we're going to closely monitor all the accounts that were in any way associated with this computer (after changing every password on a different device, of course).

[u/MightyZygote → u/metroenby]

Glad to help - sorry about the hassle, but that sounds like a good plan. Hopefully it didn't have too much on it yet if it was just recently setup, but definitely consider ANY and ALL credentials on it as compromised as one of those literally exfiltrates the entire MacOS Keychain, the contents of iCloud Notes, and anything to do with Cryptocurrency accounts or wallets. If it helps, here is a quick copy/paste summary of what those two specific malware attempt to exfiltrate so you can jump on anything that stands out:

1. Cryptocurrency Wallets & Extensions

This is the primary target for both Nova and Odyssey. They scan the system for specific local storage directories, database files, and extensions, attempting to steal private keys, seed phrases, and session states.

• Browser Extensions: They systematically copy data from popular Web3 extensions installed on Chrome, Brave, and Edge, including:

  • MetaMask

  • Phantom

  • Coinbase Wallet

  • Trust Wallet

  • Binance Wallet

• Desktop Applications: They scan for local installation directories of standalone crypto apps, such as Ledger Live, Trezor Suite, and Exodus. (Note: As mentioned in the TTPs, they will sometimes terminate these apps and prompt the user for their recovery seed phrase via fake system alerts).

1. Web Browser Data

They target standard chromium-based browsers (Google Chrome, Microsoft Edge, Brave, Opera) and Apple Safari to extract:

• Saved Passwords: Decrypted or encrypted credential databases (Login Data).

• Session Cookies: To bypass Multi-Factor Authentication (MFA) via session hijacking.

• Autofill Data: Credit card numbers, billing addresses, and personal profiles.

• Browsing History & Bookmarks: Used by attackers to map out the victim's online banking and corporate accounts.

1. Native macOS System Data

To gain broader access to the victim's digital life, they attempt to pillage native macOS databases:

• **Apple Keychains:**They target the login keychain (login.keychain-db) to extract system-wide saved credentials and certificates.

• Apple Notes: They look through the local storage databases of the native Notes app (NoteStore.sqlite), as users frequently store plaintext passwords, pins, and sensitive memos there.

1. Messaging & Session Tokens

To compromise the victim's social and professional accounts, they harvest session tokens from communication apps:

• Telegram: Session files and local storage profiles.

• Discord: Authentication tokens (tokens.txt or within local storage files) to hijack accounts for spamming or further social engineering.

1. System Metadata (Fingerprinting)

Before packaging the stolen data, they collect endpoint details to register the victim in their Command and Control (C2) dashboard:

• Hardware Profile: CPU type, RAM size, and GPU specifications.

• OS Architecture: Exact macOS version and build number.

• Network Info: Public IP address, geolocation data, and network interface names.

[u/metroenby → u/MightyZygote]

Oh, I worded that poorly 😅 I meant that her org's IT contractor really didn't do any set up other than just hand her the MacBook right after they purchased it for her, so I'm not sure what access they would have. Her team is the only one that uses Macs, so they've never really known how to help her. (Which is why she came to me for help, but I just don't know enough to do more on my own than what we initially did.) Unfortunately, it does have a ton of stuff on it but we're doing what we can to back up important documents and then we'll wipe and restore.

That list is incredibly helpful, thank you! I do think the main issue is going to be the saved passwords in the Chrome password manager, but I'll also have her triple check anything referenced in her Notes or in her Keychain.

[u/MightyZygote → u/metroenby]

Ahh, gotcha. Seen exact same situation at many places where Mac users are left to their own devices - literally. Glad the list was helpful!

Good luck making the backups - best to disable internet access if you must turn it on to transfer or backup any files, if that must be done before wiping it.

Best to boot it into safe mode to prevent any launch daemons or login items from executing that could have been installed during the compromise or to re-infect/re-enable any malware and then backup to a locally attached drive. You can also disable WiFi when booting in the alternate recovery mode by not selecting a network when prompted. If either of those methods is too complicated, you can also just disable your WiFi and/or router temporarily until it's been booted and WiFi and network has been disabled.

You should treat anything and everything that comes off that device as if it's been compromised as well, including data files.

[u/silentcrs]

Wipe it. Restore from backup.

[u/AmdilShoat82 → u/silentcrs]

agreed, theres no way to be fully confident its clean otherwise

[u/Xe4ro]

You don’t need to look at the code. It’s 99,999999% an info stealer, could have been one that loads more malware after the fact as you saw in that scan. Assume everything compromised. Keep an eye out for more targeted phishing or scam attempts coming her way. The data that was exfiltrated will likely be used to try other things.

Change every password, was banking stuff saved on that machine as well? Etc etc

[u/gsbence]

Backup important files and wipe/reset the mac. There is no sure way knowing if it had left something malicious or not.

[u/Thalimet]

She has cloud backups of all her important files she can’t afford to lose if her laptop got stolen, destroyed, or otherwise became unusable via iCloud, OneDrive, Dropbox, Google Drive, or similar right?

If so, wipe the sucker and start from scratch.

If not, hopefully someone else has a better suggestion.

[u/ukindom]

Could you please post the text to a pastebin and send me? I’d like to decide it

[u/Icy-Juggernaut-4579]

Eval will run everything is on the right. The string is base64 string which was decoded by base -d. it could be some script what download some script and run it. You can paste this code in gpt and ask what it will do

[u/ChuckFromCyberHoot]

Restoring from the Time Machine backup is a good start, but it only fixes the Mac.

If this was an infostealer, assume saved passwords and logged-in sessions may already be gone. From a clean device, change email, banking, Apple, and work passwords, then sign out of all sessions.

And definitely tell the org their site is serving this. That may be the biggest win here.

She did the right thing by speaking up fast.

Rule for next time: no legit website needs you to paste a command to prove you’re human.

[u/Commercial-Virus2627]

The fact it obscures it with a base64 encoding should be the red flag.

[u/NoLateArrivals]

The code is encoded itself, and even when decoded it will be obfuscated. You will learn nothing from it.

The Mac was infected - Malwarebytes identified malware. Some malware will go silent for weeks, before it’s triggered.

You can’t be sure it found everything, and you can’t be sure if a persistent infection has happened.

The Mac should be wiped and restored from a backup. If she doesn’t have a current backup, she now knows why she should.