Overview
- Security researchers and an X user first flagged the compromise, and PCMag reproduced a fake Cloudflare page that asked macOS visitors to copy a hidden command into Terminal that fetched an infostealer called “ClickFix.”
- MetaMask displayed warnings that labeled the site potentially deceptive and warned of malicious transactions and stolen assets when users tried to visit the store.
- TechCrunch and Decrypt report the Based Apparel storefront went offline on Friday after the alerts and that site owners have not provided substantive public comment.
- The malicious command decoded and ran a shell script that researchers say can collect Chromium browser data, session tokens, and crypto wallet files and then send them to a hacker‑controlled server, but investigators have not confirmed the scale of any losses.
- The store is owned by Kash Patel and Andrew Ollis and is linked on the Kash Foundation site, and the incident highlights broader risks from copy‑paste Terminal scams and how infostealer campaigns can target crypto users and legitimate sites.