ClickFix was the week's universal crimeware delivery vector, and macOS gained a coercion playbook — five families this week converged on paste-into-terminal delivery, local password validation before theft, and decentralized dead-drop C2
The week's crimeware is best read as one pattern with five instances, because the reuse is where the detection leverage is.
ClickFix removed the exploit from the intrusion. All five families started from paste-a-command-into-a-terminal social engineering rather than a vulnerability: ClickLock and CrashStealer on macOS, ACR Stealer's two chains, TELEPUZ (via a ClickFix→Vidar hand-off), and UAT-11795's Starland RAT (a ClickFix lure running mshta.exe). When the initial access is the user pasting a command, the earliest reliable telemetry is process lineage — a shell, mshta, rundll32 or osascript spawned shortly after a browser/clipboard interaction, with no dropped-file exploit stage to catch upstream.
macOS gained a credential-coercion playbook, and Europe is the target. Two independent macOS families reached the same escalation this week. Jamf's CrashStealer prompts for the login password and "validates it locally with dscl -authonly" before unlocking the keychain and profiling installed EDR (Jamf, 2026-07-13). Group-IB's ClickLock is more aggressive: it kills every visible application roughly every 210 ms — for up to ~83 hours — leaving only a fake password dialog on screen until the victim surrenders the macOS password (validated locally, so only the correct one is exfiltrated), and a parallel module coerces a real Keychain-authorization dialog to steal Chrome's Safe Storage key; more than 50% of the ~100 identified victims across 33 countries are in Europe (Group-IB, 2026-07-16). For a constituency issuing macOS endpoints, this is the week macOS credential theft stopped being a footnote.
Windows RATs shared evasion and a blockchain fallback. Elastic's TELEPUZ executes indirect syscalls from the .text section of a randomly chosen legitimate DLL to bypass user-mode hooking, patches AMSI/ETW, and resolves its C2 through four decentralized fallbacks — a Telegram bio, a Steam profile, a DNS TXT record and a Polygon smart contract (Elastic, 2026-07-16); Talos's Starland RAT independently uses a Polygon smart-contract dead-drop as its fallback C2 and patches AMSI/ETW before injecting shellcode. Microsoft's ACR Stealer chains both end in DPAPI theft of Chromium credential stores (Microsoft, 2026-07-16).
ATT&CK mapping
6 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Execution TA0002
T1059.001Command and Scripting Interpreter: PowerShell
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
T1204User Execution
An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.
Defense Impairment TA0112
T1685Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.
Credential Access TA0006
T1555.001Credentials from Password Stores: Keychain
Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.
T1555.003Credentials from Password Stores: Credentials from Web Browsers
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
Command and Control TA0011
T1102Web Service
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.