ClickFix on macOS: Documentation Trust, User Persistence and a Polygon Dead-Drop Resolver

A forensic case study in borrowed credibility, 160-second containment, modular collection and longitudinal infrastructure analysis.

The first control looked almost insultingly simple: “Prove you’re Human.” I had reached it through a public link in the README of an open-source developer tool. That path supplied the page with credibility before the page had earned any of its own.

Then the site asked me to open Terminal.

That should have ended the interaction. Instead, I briefly interpreted it through the context that had brought me there. Developers routinely move between documentation, OAuth handoffs and command-line setup. The dangerous instruction felt locally plausible because every preceding step belonged to a familiar workflow.

The page wrote an obfuscated command to my clipboard. I pasted it and pressed Return.

At 14:50:28 UTC, I raised the first recorded alert. Sixteen seconds later, I had identified an active malicious process. Killing it did not solve the incident; it returned. At 101 seconds, I found the user-scoped LaunchAgent responsible for persistence. At 160 seconds, the identified process and persistence path were absent from the tested locations.

That was containment of the observed path. It was not the end of the investigation.

The first vulnerability was inherited trust

The browsing path began in the README of redhat-developer/lsp4ij, where external links pointed readers to a domain outside the repository. The source code, dependencies, builds, releases and update infrastructure of LSP4IJ remained outside the observed compromise path. The exposure lived in documentation.

This distinction matters. The evidence established that a trusted project sent readers through a mutable external destination that later produced the malicious redirect observed in the incident. It did not establish how control of that destination changed. Domain expiration, registration changes, account compromise, DNS modification and other control-path failures remained possible explanations.

Calling this a software supply-chain compromise would overstate the evidence. Calling documentation “outside the security boundary” would understate how users experience it.

A maintainer who publishes an external link delegates part of the reader experience to an independently mutable system. The repository may remain cryptographically unchanged while the destination, redirect chain or ownership behind that link changes completely. Documentation links are runtime dependencies for human trust.

ClickFix trust and execution chain

Figure 1. The observed trust and execution chain. The green statements delimit what the evidence does and does not attribute to the upstream project and the recovered malware.

The user became the transport

The lure followed the ClickFix primitive:

show a fake verification control;
place a command on the clipboard;
instruct the user to open a command interpreter;
induce the user to paste and execute the command manually.

The browser did not need a memory-corruption exploit. The user carried execution across the boundary. MITRE ATT&CK describes this class as T1204.004, Malicious Copy and Paste.

The mechanism is social and technical at the same time. The page makes an unsafe operation feel like the continuation of a legitimate setup flow. Traditional browser controls see a page and a clipboard write; terminal telemetry sees a user-pasted command. Detection becomes stronger when those events are correlated.

Once executed, the decoded stages established a broader system:

the clipboard command retrieved and launched another stage;
a resident script and plist under the user's LaunchAgents directory established persistence;
RunAtLoad and KeepAlive caused the process to start and return after termination;
a hidden-input AppleScript dialog imitated a system-related credential prompt;
a resident bot fingerprinted the host, polled command-and-control infrastructure and dispatched module tokens;
the recovered collector contained browser, wallet, Apple Notes, local-file, archive-staging and upload functionality.

The persistence was user-scoped. It was not a root LaunchDaemon. The dialog was credential phishing; it was not a PAM or Touch ID bypass. A hidden AppleScript answer masks characters visually while returning the entered text to the script.

These corrections are not editorial modesty. They determine which controls and privileges matter.

Capability is not impact

A credential-staging file existed before my first alert. The recovered collector contained logic capable of including it during archive staging. Those facts establish local credential capture and collection capability.

They do not, by themselves, establish completed exfiltration.

My home-lab firewall did not record the expected connection to the upload endpoint during the incident window. I had also refused the later authorization interaction and moved immediately into containment. The report therefore distinguishes three layers:

Evidence layer	Supported conclusion
Live incident state	The local artifacts and processes actually observed on the host.
Recovered code	Behaviors the malware was capable of performing.
Network and transfer evidence	Whether a specific collection or upload completed.

Static capability is important for response planning. It is not proof that every branch executed. The same rule applies to agent-assisted research: a possible call path is not a runtime trace, and a plausible diagnosis is not a demonstrated cause.

The first 160 seconds

The recurrence after the first process kill was the useful clue. It changed the problem from “terminate a suspicious command” to “identify the mechanism that recreates it.” A process tree connected shell and AppleScript activity to a randomized plist in the user's LaunchAgents directory.

The containment sequence became:

identify the active process;
trace the process responsible for recurrence;
locate the persistence artifact;
unload the specific LaunchAgent;
terminate the remaining process tree;
verify the tested locations again.

The 160-second number measures first recorded alert to containment of that identified path. Deeper investigation continued. Credential rotation was recorded later, after the live persistence problem had been removed.

The response was AI-assisted and human-directed. I supplied live state, authorized bounded actions, corrected the investigation when it drifted and made the consequential decisions. Models proposed checks and compared outputs. Process listings, recovered files, code analysis and dated observations formed the evidentiary record.

The malware led to Polygon

The incident became a threat-intelligence study when the recovered bot exposed its resolver.

Rather than carrying one fixed C2 hostname, the sample issued read-only eth_call requests to public Polygon RPC endpoints. It queried a contract with a fixed selector, decoded the returned bytes as a dynamic ABI string and used the resulting hostname as its command-and-control destination.

The same contract address and selector returned three different hostnames across the investigation and observation window. A separate state-changing transaction could update the pointer without modifying malware already installed on a host.

This maps to MITRE ATT&CK T1102.001, Dead Drop Resolver. The design does not make the campaign invulnerable. It divides the control problem:

domain action can interrupt the current endpoint;
host remediation can remove installed persistence;
documentation repair can close the known arrival path;
resolver monitoring can reveal later pointer changes.

Entry path, host, endpoint and resolver are different surfaces. Treating any one as the whole campaign leaves the others untouched.

Layered defensive controls

Figure 2. Each defensive action addresses a different layer. The result is a coordinated response rather than one universal takedown.

Sixteen observations changed the report

The resolver made a single-day report fragile. Between 2 and 10 July, I maintained sixteen timestamped records covering DNS, HTTP, TLS, registration data, the hardcoded fallback IP and the contract output.

The series recorded the first C2 hostname becoming unavailable, another hostname appearing in the resolver, changes in payload and landing-page availability, intermittent fallback behavior, and a later hostname rotation preserved in the final committed record.

Monitoring also produced prospective hypotheses about domain lifecycle, contract rotation and recovery timing. Each statement had to exist before the outcome it proposed to evaluate. Stable identifiers, original wording, fixed windows and explicit outcome criteria prevented retrospective editing from turning a guess into a prediction.

Results were recorded as directional matches, partial support, unresolved outcomes or failures. The delay between incident and publication was therefore part of the investigation: it allowed infrastructure behavior to become a time series rather than an anecdote.

What the agent behavior revealed

Different model and harness combinations produced different safety behavior during incident response and longitudinal research. One configuration supported urgent containment. Another refused a bounded acquisition step because the surface resembled malware retrieval. Elsewhere, an agent accepted active probing that exceeded the intended read-oriented collection boundary.

These observations do not rank model vendors. They expose an orchestration problem.

I organized the behavior into four categories:

Classifier blindness — harmful intent passes through a surface that appears benign.
Surface-pattern false positives — legitimate defensive work is blocked because its form resembles a prohibited action.
Decision collapse — context is compressed into an allow, refuse or confirm decision without preserving the distinctions that matter.
Harness trust gaps — tool permissions, scheduler behavior and communicated guarantees diverge.

The taxonomy describes observed workflow effects. It does not claim access to any provider's undisclosed classifier internals.

The practical test is broader than refusal rate: Was the allowed action appropriate? Was the denied action actually unsafe? Did the tool stay within the approved boundary? Did the final claim remain aligned with the evidence?

Publishing agent work without publishing private reasoning

The public repository includes rewritten reasoning documents for the incident response and longitudinal investigation. They preserve strategy, tool use, delegated work, hypothesis evaluation and human corrections without exposing private chain-of-thought or sensitive local paths.

Cryptographic commitments identify the private source material used for the edition. The reader can inspect the causal sequence—how a question became an observation, how an observation constrained a hypothesis and where a human decision bounded the work—without receiving the private transcript itself.

This publication method is part of the security model. It allows agent orchestration to be reviewed while preserving the boundary between provenance and disclosure.

What changes for defenders

The case supports six concrete practices:

Treat documentation links as lifecycle-managed dependencies. Monitor redirects, ownership, DNS and content drift, not only HTTP availability.
Correlate the browser-to-terminal transition. The high-signal event is a lure followed by user-pasted execution.
Monitor user LaunchAgents in context. Randomized labels, restart semantics and shell or AppleScript children deserve investigation.
Treat hidden-input dialogs as untrusted UI. Visual similarity to a system prompt is not authentication.
Monitor the resolver separately from the current endpoint. Preserve contract, selector, returned hostname, originating process and dated network state.
Separate recovered capability from demonstrated impact. Claims of theft or exfiltration require execution or transfer evidence beyond static code.

The trust came from somewhere

The attack did not require me to abandon reason. It constructed a context in which a dangerous action felt locally reasonable. The instruction borrowed legitimacy from the path that delivered it.

Agentic systems introduce another inherited-trust layer. They can accelerate containment, reverse engineering, monitoring and publication. They can also overreach, refuse the wrong action or convert an attractive explanation into an unsupported conclusion.

Provenance is what keeps acceleration from becoming fiction.

The checkbox looked trivial. The trust path behind it was not.