macOS ClickFix Crimekit Uses Polygon Smart Contracts to Deploy AMOS Stealer and XMRig Miner

This report details a macOS-targeted campaign that lures victims with a fake CAPTCHA/ClickFix page to execute a curl|bash chain from a Cloudflare Worker, installs a persistent LaunchAgent loader which resolves and rotates C2 via a Polygon smart contract (EtherHiding), and deploys an AMOS infostealer, persistent backdoor agent, and XMRig miner; it includes IoCs and suggested detection hunts (Terminal-launched curl|bash, osascript usage, new LaunchAgents, eth_call to the identified contract).