ClearFake: New infrastructure identified for macOS payload delivery

ThreatFox documented 35 new domains associated with the ClearFake campaign, a malware distribution network known for utilizing compromised websites and EtherHiding techniques to facilitate drive-by downloads. The newly identified infrastructure shows a targeted focus on macOS-based payloads, evidenced by associated naming conventions and metadata in the threat intelligence reporting.

Impact

ClearFake campaigns utilize social engineering, often manifesting as fraudulent update prompts, to trick users into downloading malicious binaries. Observed activity primarily concerns payload delivery via drive-by download or deceptive landing pages.

Recommendation

• Block the identified domains at the organization's DNS resolver and web proxy.
• Monitor EDR telemetry for browser-initiated downloads of suspicious DMG or PKG files, particularly from the newly identified infrastructure.
• Review web proxy logs for user traffic directed to the listed ".xyz", ".click", and ".store" domains.