ClickFix attack pushes macOS infostealer for crypto theft attacks

Summary

A Go-based malware, delivered through ClickFix attacks targeting macOS users, is stealing cryptocurrency, browser passwords, and Apple Keychain data. The malware can intercept and redirect cryptocurrency transactions, diverting a calculated percentage of funds rather than emptying wallets entirely. Researchers discovered it after responding to a ClickFix incident where a user was tricked into running a malicious Bash script.

Full text

ClickFix attack pushes macOS infostealer for crypto theft attacks By Ionut Ilascu August 6, 2026 06:37 PM 0 A Go-based malware delivered in ClickFix attacks targeting macOS users is stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. ​The malware can intercept and redirect transactions with various cryptocurrencies. Although it can empty wallets entirely, it can also calculate the total value of a transaction to determine how much to divert to the attacker. Security researchers at Managed Detection and Response (MDR) services company Huntress discovered the payload after responding to a ClickFix incident. The targeted user received an email with a link to a page instructing them to run a command in Terminal. This downloaded a Bash script acting as a profiler and malware loader that collected system information (e.g., CPU, RAM) and retrieved a Mach-O payload that matched the victim system’s processor architecture. The profiler also identified the account name for the currently logged-in user and created a directory named after trustd, the macOS process responsible for validating cryptographic certificates and code signatures. It copied the infostealing and crypto-draining payload to the directory as com.apple.verified and removed the com.apple.quarantine extended attribute to prevent Gatekeeper from treating the file as quarantined and showing a security alert when executed. According to Huntress’ analysis, the malware establishes persistence and increases privileges by collecting system credentials via a fake error created using the osascript utility. Fake dialog box prompting for admin passwordsource: Huntress The stealer payload checks the storage for files containing credentials, identified both by name and their extension. “Browser password databases, the Apple Keychain, and cached credentials in browser cookies are all targeted,” Huntress says. However, the Go-based malware also includes code that modifies cryptocurrency transactions before they are signed, and can be configured to redirect to the attacker only a percentage of the funds. Malware can be configured to drain a certain crypto amountsource: Huntress Huntress says that it is the first time they analyzed a crypto drainer that did not empty victims' wallets but could remove less than the total amount. Additionally, the researchers observed separate functions that determined the value of 1% of the wallet’s content, depending on the cryptocurrency type. Among the targeted cryptocurrency assets are Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP. According to Huntress, the malware communicates to shared IP addresses in Autonomous System (AS) 210644, which is “operated by a Russian corporation known as the Aeza Group.” The company and individuals affiliated with it have been sanctioned by the US and the UK for providing bulletproof hosting services to ransomware groups. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: New ClickLock macOS malware traps users into revealing login passwordNew CrashStealer malware poses as Apple crash reporting toolNew XCSSET variant targets macOS devs via compromised Xcode projectsFake Roblox Xeno script launcher pushes infostealer, RAT malwareArch Linux disables AUR package adoption to stop malware flood

Indicators of Compromise

• ip — 210644

Entities