ClickFix on a typo, C2 in a smart contract
This is a div block with a Webflow interaction that will be triggered when the heading is in the view.
This is one buyer outcome on a shared traffic platform. It is not a claim that every domain in the ~115,000-front footprint delivers malware. It shows how Resource Development inventory and malvertising-style delivery can meet.
The lure
On 20 October 2026, a Malanta researcher browsed iuntuit[.]com, an Intuit typo on redfoxdns and one of the 466 seeds. The browser reached hxxps://sso.crypsend[.]click/idcheck/vantdot.html, which showed a familiar "I am not a robot" check.
crypsend[.]click was registered at NameCheap the same day as the visit and sits behind Cloudflare.
Clicking the box copied a base64-wrapped command that pipes hxxps://7ulk.irvinaurus[.]fit/clear-cache.sh into the shell. The page asked the user to paste it into a terminal. Classic ClickFix (MITRE T1204.004).
We decoded every stage statically. Nothing was executed.
Persistence and the dead drop
The script rebuilds a hidden AppleScript from character codes, padded with junk variables. It writes a launch agent, com.Apple.ddjnmuymodzjkyov, that restarts at every login, and starts it immediately (T1543.001, with Apple-style masquerading in the name).
The agent does not hard-code a durable C2 hostname as its only source of truth. It queries a smart contract on Polygon (0xA3a603F8...C2A0) through public RPC nodes and reads the stored string as its command server. On 20 October that string was secdarvin2026[.]icu.
It then posts a campaign ID to that server and runs whatever AppleScript comes back with the user's rights. The final payload was not retrieved.
Confidence: High for the script's behaviour. Medium for how the visit reached the lure. The session started on the operator's front domain and redirected to the fake CAPTCHA page; intermediate hops were not fully recorded, so we cannot name which party bought or placed the lure. Cloud visits to the same front domain saw only a search page.
Same pipes, other SKUs
On the same infrastructure, controlled visits also reached:
- a MEGA file page via a six-day-old redirector aimed at Brazilian Windows profiles (file not retrieved)
- an off-store Android app page via
forkstrong[.]com(app not analysed)
Those are separate buyer paths. The durable layer is the acquisition and screening machine described in Blogs 0-2.
Hunt notes for macOS fleets
- User launch agents under
~/Library/LaunchAgents/named likecom.Apple.* osascriptlaunched from bash or shell pipelinescurl(or equivalent) calling public Polygon RPC endpoints from unexpected processes- Clipboard-driven "paste this into Terminal" prompts after fake CAPTCHA pages
- Network to freshly registered
*.fit/*.icu/*.clickhosts tied to the chain above
Block the lure page, stage-1 host, and command server. Leave public Polygon RPC providers and Cloudflare as shared infrastructure unless your policy says otherwise.
The Bottom Line
ClickFix did not need its own typo empire. It rented screened visitors from a traffic machine that also sells affiliate clicks and grey offers. Defenders who only track the payload host will keep playing replacement. Defenders who also track the acquisition layer shorten the next setup window.
Full static analysis notes and indicator appendix: technical report. Next: a 25-domain batch flagged months before its traffic burst.
Pre-Attack Prevention. Hit the source.
