looking at the source code, the entire phishing page is an iframe created through `srcDoc`. the script itself has no command for Mac users to run, so in my case it just copies "Oops..." to my clipboard - the iframe only loads the first time a user visits the page, after which only a tracking script remains.

it also sets some interesting scripts to your LocalStorage, which are evaluated upon each page load.

the first sends an object to another remote server, { c: <contract address>, e: encrypted base64 blob of basic device info }.

the second calls an API to make said smart contract run the function whose selector is 0xca3348d9, with no parameters, and return the result. the address is 0x58460d0b3d4d6b03761c89120393c0c676676496

edit: this is wildly complex, way more so than a traditional ClickFix attack. it's fetching JS scripts from a Ethereum/Base contract and executing them - i've never seen something like this before. it's got a kill switch too and a cooldown, so i'm no longer experiencing the initial malware dropper on my device "fingerprint"