Security researchers at Huntress have identified a new ClickFix campaign targeting macOS users with a Go-based infostealer capable of draining cryptocurrency wallets alongside browser-stored passwords, Apple iCloud Keychain data, and cached credentials.
The infection begins with an email containing a link to a page that instructs the victim to run a command in Terminal, a classic ClickFix social-engineering pattern. Running the command downloads a Bash script that profiles the host, collecting CPU and RAM details and identifying the logged-in user, before fetching a Mach-O payload matched to the system’s processor architecture.
Evasion and Persistence
To avoid detection, the malware creates a directory named after trustd, the legitimate macOS process responsible for validating certificates and code signatures, and copies itself there as com.apple.verified. It then strips the com.apple.quarantine extended attribute, preventing Gatekeeper from flagging the file or triggering a security warning on execution. For persistence and privilege escalation, the malware uses osascript to display a fake system error dialog that tricks the victim into entering their admin password.
Selective Crypto Draining
Once installed, the stealer searches for files matching known credential formats, targeting browser password databases, Keychain data, and cached credentials in cookies. Its more notable capability lies in cryptocurrency theft: the malware can intercept and modify transactions before they are signed, targeting Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP. Rather than always emptying a wallet, it can calculate a transaction’s total value and divert only a configured percentage, including functions that isolate exactly 1% of a wallet’s holdings depending on the currency. Huntress noted this is the first crypto drainer it has analyzed that can be tuned to skim partial amounts rather than draining funds entirely.
Infrastructure Ties
Huntress observed the malware communicating with IP addresses in Autonomous System 210644, linked to the Aeza Group, a Russian hosting provider sanctioned by both the US and UK for supplying bulletproof hosting to ransomware operators.
Security teams should treat unsolicited emails urging recipients to paste and run Terminal commands as a high-risk indicator, and monitor for unexpected processes mimicking system daemon names or unauthorized removal of quarantine attributes.