ClaudeFix: Shared Claude Chats Meet ClickFix

MITRE Techniques

• [T1204.004 ] User Execution: Malicious Copy and Paste – Victims were instructed to paste and run commands in the terminal to install the payload (‘paste-and-run commands’).
• [T1059.004 ] Command and Scripting Interpreter: Unix Shell – The attack used curl piped to zsh and later eval/osascript to execute scripts (‘curl -kfsSL …|zsh’, ‘executed in the terminal using the eval command’, ‘piped directly to osascript’).
• [T1140 ] Deobfuscate/Decode Files or Information – The command hid the destination URL with Base64 encoding and the script decoded Base64 then gzip content (‘obfuscated using Base64 encoding’, ‘Base64-decoded then decompressed using gzip’).
• [T1566.002 ] Phishing: Spearphishing Link – Victims were redirected through paid ads to shared Claude chat links containing malicious instructions (‘a paid ad in the results that points to a shared Claude chat link’).
• [T1027 ] Obfuscated Files or Information – The staging URL and script content were deliberately obscured to evade detection (‘destination URL obfuscated using Base64 encoding’).
• [T1105 ] Ingress Tool Transfer – The malware downloaded additional stages and payloads from attacker-controlled URLs (‘downloads the third stage’, ‘attempts to download three additional payloads’).
• [T1053.005 ] Scheduled Task/Job: Startup Items – The malware modified ~/.zshrc for persistence when the terminal opens (‘append a curl command … ensuring the second-stage script is downloaded and executed each time the terminal is opened’).
• [T1112 ] Modify Registry – Not applicable to macOS; no registry behavior described.
• [T1005 ] Data from Local System – The malware copied keychains, browser stores, shell histories, cloud keys, Telegram files, and documents (‘Copies all keychain files’, ‘Copies shell configuration and history files’, ‘Gathers files from selected directories’).
• [T1083 ] File and Directory Discovery – It enumerated browser files, processes, and targeted directories to collect data (‘Gathers information about running processes’, ‘Searches for known browser extensions’).
• [T1560.001 ] Archive Collected Data: Archive via Utility – Stolen data was compressed into /tmp/osalogging.zip (‘All data collected … is compressed into /tmp/osalogging.zip’).
• [T1041 ] Exfiltration Over C2 Channel – Data was exfiltrated over HTTP PUT requests in chunks (‘exfiltrates the collected data in 10MB chunks via HTTP PUT requests’).
• [T1070.004 ] File Deletion – The malware deleted staging and archive artifacts after exfiltration (‘deletes /tmp/osalogging.zip’, ‘deletes the /tmp/sync* directory’).
• [T1091 ] Replication Through Removable Media – Not observed; no removable media behavior described.
• [T1110 ] Brute Force – Not present; no brute-force activity described.
• [T1056.002 ] Input Capture: GUI Input Capture – The malware used a fake prompt to trick the victim into entering a macOS password (‘shows a fake prompt’).
• [T1614.001 ] System Location Discovery: System Language Discovery – Russian-language comments suggest attacker locale/language context, but this is not a technique used by the malware.
• [T1113 ] Screen Capture – Not described in the article.