PasteSwitch Malvertising Uses ClickFix and Blockchain C2

Summary

PasteSwitch is a large-scale, coordinated malvertising campaign that abused a verified Reddit account to distribute malicious payloads through ClickFix social engineering. The operation uses deceptive terminal commands to persuade users to execute code that installs macOS stealers, Windows loaders, and cryptocurrency clippers. Its infrastructure is highly resilient, relying on blockchain-based C2 rotation and TLS SNI spoofing to evade detection.

Investigation

Researchers from Hudson Rock and ADAMnetworks identified the campaign after a user reported suspicious HBO Max advertisements on Reddit. The investigation uncovered a complex delivery framework with separate platform-specific branches targeting macOS and Windows. Analysts also identified rotating domains and smart contracts on the Binance Smart Chain used to manage Command and Control infrastructure.

Mitigation

Organizations should enforce strict controls around terminal command execution and monitor for suspicious copy-paste social engineering behavior. Security teams should detect unauthorized scheduled task creation and in-memory shellcode execution. Monitoring for TLS SNI mismatches and unusual outbound connections to direct IP addresses can also improve detection.

Response

If malicious activity is detected, affected endpoints should be isolated immediately and credentials for accounts accessed from the compromised device should be reset. Responders should perform memory forensics to identify injected payloads such as Amatera. Blockchain activity and network telemetry should also be reviewed for connections to known PasteSwitch C2 infrastructure.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An attacker has gained initial access via a phishing link. To bypass basic signature-based detection, they use mshta.exe to execute a malicious HTA script hosted on a local temp directory. Once inside, the attacker uses an encoded PowerShell command to download a second-stage payload, attempting to hide the intent of the script. Finally, to ensure they maintain access even after a reboot, they create a scheduled task that executes a PowerShell script every time the system starts.

• Regression Test Script:

  # 1. Simulate MSHTA execution (T1218.005)
  # Creating a dummy HTA file
  $htaContent = ""
  $htaPath = "$env:TEMPmalicious.hta"
  $htaContent | Out-File -FilePath $htaPath -Encoding ascii
  
  # Triggering MSHTA (This should trigger the rule)
  Start-Process "mshta.exe" -ArgumentList "`"$htaPath`""
  
  # 2. Simulate Encoded PowerShell (T1027.017)
  # The following is an encoded version of 'Write-Host "Malicious Payload Executed"'
  $encodedCommand = "V3JpdGUtSG9zdCAiTWFsaWNpb3VzIFBheWxvYWQgRXhlY3V0ZWQi"
  
  # Triggering PowerShell with EncodedCommand (This should trigger the rule)
  powershell.exe -NoProfile -EncodedCommand $encodedCommand
  
  # 3. Simulate Scheduled Task Persistence (T1053)
  # Creating a task that runs a PowerShell command
  $taskName = "WindowsUpdateCheck"
  $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -WindowStyle Hidden -Command 'Write-Host Malicious Task'"
  Register-ScheduledTask -Action $action -Trigger (New-ScheduledTaskTrigger -AtLogOn) -TaskName $taskName -Description "Simulated Persistence"

• Cleanup Commands:

  # Remove the dummy HTA file
  Remove-Item -Path "$env:TEMPmalicious.hta" -Force
  
  # Remove the scheduled task
  Unregister-ScheduledTask -TaskName "WindowsUpdateCheck" -Confirm:$false