ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

Summary

A new Go-based malware delivered through ClickFix-style attacks is targeting macOS users, capable of stealing browser passwords, Apple Keychain data, and cached credentials. Notably, it includes a 'DRAIN' routine that can siphon funds from cryptocurrency wallets, including Bitcoin, Ethereum, and XRP, to attacker-controlled accounts. The infrastructure used for these attacks is linked to Aeza Group, a Russian bulletproof hosting provider sanctioned by the US, UK, and Australia.

Full text

ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets Ravie LakshmananAug 07, 2026Malware / Social Engineering ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host and then fetches a macOS malware payload that's compatible with the computer's CPU architecture. "While the malware payload is capable of stealing passwords, its most interesting function is its capability to slowly deplete cryptocurrency accounts, siphoning their contents into accounts under the threat actor's control," Huntress security researcher Andrew Brandt said. The attack chain begins with pasting a ClickFix command into the Terminal app, triggering the execution of a Bash profiler/loader that collects extensive system details and then retrieves a Mach-O payload that matches the victim's processor architecture. The payload is a Go-based stealer that can capture browser passwords, Apple Keychain data, and cached credentials and transmit them to a remote server operated by the threat actor. Like other macOS stealers, the malware attempts to escalate privileges by prompting the victim to enter their system credentials via a fake prompt under the guise of an "unexpected system error" and restoring damaged system files. What's notable about the malware is that it also packs in a "DRAIN" routine that checks if a cryptocurrency wallet holds funds, and if so, redirects a chunk or all of it to an attacker-controlled wallet. There exist multiple versions of the same function based on the cryptocurrency being targeted. This includes Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP. "While this may not be a brand new feature, it's the first time we have seen malware capable of emptying a cryptocurrency wallet that could be used to remove any less than the entire wallet's value," Huntress said. "The malware contained separate functions to determine just how much 1% of the wallet's contents is worth, depending on which cryptocurrency the malware targets." The server staging the malicious payloads and the command-and-control (C2) server all link back to infrastructure belonging to Aeza Group, a Russian bulletproof hosting provider that has been sanctioned by the U.S., the U.K., and Australia for facilitating bad actors. The disclosure comes as a number of ClickFix attacks have been reported in recent weeks - A macOS ClickFix campaign distributing MacSync and Atomic Stealer malware that uses a cluster of look-alike domains and implements a server-side browser-fingerprinting and hardware validation gate to conditionally serve the lures only to those visitors whose environment appears consistent with a genuine macOS browser, while blocking crawlers, sandboxes, and some automated analysis tools. A ClickFix variant that abuses Program Compatibility Assistant ("pcalua.exe"), a legitimate Windows binary, as a launcher to bypass parent-process heuristics. "The victim is tricked (via a ClickFix lure) into pasting a crafted command that spawns PowerShell, uses WMI to create cmd.exe, mounts a remote WebDAV share, and loads a malicious DLL through rundll32.exe," Palo Alto Networks Unit 42 said. "The WebDAV share is exposed over HTTPS via CDN-fronted infrastructure at a per-victim tokenized URL (UUIDv4 path) used to deliver malicious DLL. Once loaded, the DLL is leveraged to deploy infostealer capabilities on the compromised host." A ClickFix campaign that uses on-the-fly WebAssembly (wasm) module instantiation and steganography through SVG images to evade network-level detection. The activity uses legitimate-but-compromised websites to run injected malicious JavaScript that builds a wasm module that exports URLs from which the SVG files are downloaded to construct the ClickFix URL. "This final ClickFix URL is then dropped onto the DOM with a script tag to display the fake verification page," Unit 42 said. "The fake verification page presents a checkbox. When the checkbox is clicked, the page presents instructions to paste content into a Run window." The findings also coincide with the discovery of two other stealer campaigns, one which delivers Lumma Stealer via files disguised as 1080p WEBRip and Blu-ray releases of The Odyssey, a newly released movie adaptation of Homer's ancient Greek epic poem of the same name, and another which uses cracked software and pirated game lures hosted on fake websites via SEO poisoning to drop Remus, a 64-bit variant of Lumma Stealer. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Credential Theft, cryptocurrency, Cybercrime, endpoint security, Information Stealer, macos security, Malware, Social Engineering, Web Security, Windows Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders

Indicators of Compromise

• malware — MacSync
• malware — Atomic Stealer

Entities