macOS ClickFix Attack Pushes Go Infostealer and Novel Crypto Drainer

A recent ClickFix attack campaign targeting macOS users has been observed delivering a sophisticated Go-based macOS infostealer and crypto drainer designed to compromise browser credentials, Apple Keychain databases, and digital wallet assets. First identified during incident response operations by security researchers at Huntress, the threat relies on social engineering tactics to bypass built-in operating system security controls rather than exploiting unpatched software vulnerabilities.

The incident highlights a growing trend of threat actors adapting human-centric execution techniques—previously focused heavily on Windows environments—to strike macOS endpoints inside enterprise networks and developer workflows.

Anatomy of the Attack: From Phishing Email to Terminal Execution

The initial access phase begins with a phishing email directing the recipient to a malicious web page. The site presents a fake error dialog instructing the user to resolve an issue by opening the native macOS Terminal application and pasting a provided command line snippet. This human-mediated execution vector—widely referred to as a ClickFix attack—effectively circumvents web browser sandbox controls, email gateway attachment filters, and automated file-scanning security software because the initial execution originates from a legitimate user shell session.

Once the victim executes the command, the script fetches a secondary Bash script that serves as a profiler and malware loader. The profiler conducts initial system reconnaissance:

• Hardware Profiling: Querying system resource configurations, including CPU specs and installed RAM, to evaluate the host environment.
• Architecture Detection: Identifying whether the Mac runs on x86_64 (Intel) or ARM64 (Apple Silicon) architecture to request the matching native Mach-O binary payload.
• User Context Resolution: Extracting the active account name for the logged-in user to set up user-space persistence and directory structures.

To blend into standard system operations, the script creates a directory named after trustd—the legitimate macOS system daemon responsible for evaluating cryptographic certificates and code signatures. The loader downloads the primary compiled Go malware payload into this hidden location, saving it under the filename com.apple.verified.

Before launching the executable, the loader runs a command to strip the com.apple.quarantine extended attribute from the payload. macOS automatically applies this attribute to files downloaded via web browsers or network clients to trigger Gatekeeper checks and prompt users with untrusted software warnings. By manually stripping the quarantine flag via shell command prior to execution, the malware avoids triggering Gatekeeper alerts entirely.

xattr -d com.apple.quarantine /path/to/com.apple.verified

Credential Harvesting and Smart Crypto Draining

Once active, the Go-based malware establishes persistence and attempts to elevate its privileges. To obtain administrative access or unlock stored credentials, the threat invokes AppleScript via the native osascript utility to display a fake system error popup prompting the user for their account password.

After securing credentials, the infostealer scans local storage for sensitive databases based on specific file names and extensions. The primary targets include:

• Apple Keychain: Harvesting local password items, private keys, and application tokens.
• Browser Databases: Searching Chromium and Firefox profile directories for stored login passwords.
• Cached Web Session Cookies: Scraping active browser session state tokens to facilitate session hijacking against corporate SaaS platforms.

In addition to traditional credential harvesting, the payload includes specialized logic for intercepting and altering cryptocurrency transactions before they are cryptographically signed. Unlike conventional crypto drainers that immediately sweep 100% of a victim’s wallet balance—a high-visibility action that instantly alerts the victim and flags incoming addresses—this malware features a granular financial diversion mechanism.

The threat incorporates mathematical routines designed to calculate the total value of held digital assets and calculate a 1% threshold of the wallet’s total balance. Depending on its configuration, the malware can divert small percentages of outbound transactions to attacker-controlled wallets rather than emptying the account in a single sweep. Supported assets for transaction manipulation include Bitcoin (BTC), Ethereum (ETH), Litecoin (LTC), Dogecoin (DOGE), Monero (XMR), and Ripple (XRP).

Infrastructure and Sanctioned Hosting Networks

Command-and-control (C2) communication from infected macOS hosts routes to shared IP addresses hosted within Autonomous System (AS) 210644. This autonomous system is operated by Aeza Group (Aeza International LTD), a Russian hosting provider.

Aeza Group and several associated individuals are subject to official financial sanctions imposed by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the United Kingdom’s Foreign, Commonwealth & Development Office. These regulatory enforcement actions stem from Aeza Group’s role in supplying bulletproof hosting services to cybercrime syndicates, including ransomware groups, infostealer operators, and illicit financial networks that intentionally ignore abuse complaints and international law enforcement requests.

Organizational Blast Radius and Remediation Directives

The blast radius for organizations affected by this campaign extends beyond the immediate loss of cryptocurrency funds. Because the stealer targets browser cookies, saved passwords, and system Keychain items, a single compromised workstation can expose enterprise single sign-on (SSO) sessions, cloud management console access tokens, developer SSH keys, and internal API secrets.

Security teams should implement targeted behavioral detections and host-level enforcement rules focused specifically on the indicators used in this campaign:

1. Terminal Command Execution Restrictions: Train end users never to copy and paste shell commands directly from web browsers into Terminal. Consider utilizing Endpoint Detection and Response (EDR) rules to detect shell sessions spawning curl or wget commands piped directly into bash or zsh.
2. Monitor AppleScript Dialog Generation: Audit process executions where osascript is invoked with parameters creating display dialogs requesting user passwords (e.g., osascript -e 'display dialog ... with hidden answer').
3. Track Extended Attribute Modifications: Create telemetry detections for native utility execution of xattr -d com.apple.quarantine targeting executable files located within user profile paths or spoofed system folders.
4. Network Access Control: Block inbound and outbound traffic at the perimeter and host firewall level to IP ranges associated with Autonomous System AS210644 (Aeza Group).