r/mac • u/Delicious_Volume3306 • 3h ago
Question "SafeLink" wants to run Terminal commands to prove I'm not a robot
I encountered this on a local business' website today. The terminal command it provides appears to be base64 encoded to obfuscate it. Anybody experienced anything like this? Googling for this shows nothing.
EDIT: As people in the comments point out, it's a variation of the ClickLock malware. It doesn't appear to be the main version, though. This is modified.
I investigated it a little.
The command is base64 encrypted, and when unencrypted, it tells Terminal to download a shell script from a compromised website.
That shell script is also base64 encrypted. When unencrypted, it installs a launchctl shell script and has another load of base64 crap.
When that's unencrypted, it's tries to run an AppleScript -- which is again obfuscated by referencing every letter as "(ASCII character 46) & (ASCII character 112)" etc. I asked Claude to figure this out (I lack the skills to create something like a Perl or Python script to do so), and Claude said it was a blockchain-hosted C2 (EtherHiding) feeding a macOS
osascriptdropper -- so this component also would download presumably the payload components.
That's as far as I got. This is as close as any malware as I'd like to get, and I feel a little dirty. I already use apps like KnockKnock to monitor persistence locations, but I'm giving my Mac a good sweep now just to make sure everything's OK.

