A highly targeted phishing campaign is hitting macOS users in the crypto and tech sectors. Security firm SlowMist analyzed the attack after Chainbase Lab flagged suspicious emails disguised as “audit/compliance confirmation.” The goal: steal token vesting data and credentials.
Emails Masquerade as External Audit Requests
Attackers first ask recipients to confirm their company’s legal English name in a social engineering step. Then they send emails with subject lines “FY2025 External Audit” or “Token Vesting Confirmation – deadline.” The attachments, named “Confirmation_Token_Vesting.docx.scpt,” appear as ordinary Word or PDF files but are actually AppleScript executables.
Multi-Stage Fileless Malware in Action
Once opened, the script displays fake macOS update or repair windows to lower victim suspicion. It collects system info (CPU, macOS version, language) and sends it to remote servers like sevrrhst[.]com. The servers then decide which payload to deliver. Subsequent scripts enable password theft, remote command execution, and dynamic payload injection.
Bypassing macOS Privacy Controls
The attack specifically targets macOS's Transparency, Consent, and Control (TCC) safeguards. By modifying system folders and injecting SQL queries into the TCC database, the scripts covertly gain access to documents, downloads, desktop, camera, screen capture, and keyboard tracking. A Node.js backdoor facilitates remote control and dynamic malware execution. When credential prompts appear, attackers verify the password locally before exfiltrating it via Base64-encoded transfers — the pop-up window is indistinguishable from a real system prompt.
Experts advise: even trusted-looking emails can be dangerous. If exposed, disconnect immediately, reset permissions, and run a security scan.