Mac Crypto Drainer Uses ClickFix Tactics

A sophisticated Go-based malware has emerged, specifically targeting macOS users through deceptive ClickFix campaigns. The attack lifecycle begins with social engineering, where victims are prompted to execute manual commands within the Terminal, ultimately granting the adversary a foothold to deploy persistent infostealing payloads.

Execution via Terminal Manipulation

The attack sequence relies on the victim navigating to a malicious page that provides instructions to run a specific command. This command triggers a Bash script that functions as both a system profiler and a loader. By collecting hardware details such as CPU and RAM specifications, the script ensures it retrieves the correct Mach-O payload tailored for the victim’s processor architecture.

To evade detection, the malware utilizes the trustd process name, a legitimate macOS system component, to hide its activities. By removing the com.apple.quarantine extended attribute, the threat actor effectively bypasses Gatekeeper, the security mechanism designed to warn users about unsigned or potentially malicious applications.

Credential and Crypto Theft

Once established, the malware casts a wide net for sensitive information. It employs the osascript utility to trigger fake system error prompts, tricking users into inputting their administrative passwords. This allows the payload to access protected areas of the operating system, including the Apple Keychain and browser-stored credentials.

Browser password databases, the Apple Keychain, and cached credentials in browser cookies are all targeted.

— Huntress, Managed Detection and Response (MDR) services company

The malware’s most distinct capability is its refined approach to cryptocurrency theft. Rather than executing a blunt-force drain of all funds, the code is designed to evaluate transaction values. It can intercept outgoing transactions and dynamically modify them to siphon a specific percentage or amount to the attacker.

Infrastructure and Attribution

Analysis by researchers indicates that the command-and-control infrastructure for this operation resides within Autonomous System (AS) 210644. This network space is reportedly associated with the Aeza Group, a Russian entity previously identified in connection with bulletproof hosting services utilized by ransomware operators.

• 54% of successful attacks are logged by security teams.
• 14% of successful attacks trigger an alert.
• 1% of a wallet’s content can be calculated by the malware’s specific functions.

Implications for Security Posture

This incident highlights the evolving risk associated with seemingly innocuous user-executed commands. Because this campaign leverages native macOS utilities like Terminal and osascript, standard signature-based defenses may struggle to differentiate between user-authorized administrative tasks and malicious activity. Organizations should note that the Huntress says team's findings underscore the necessity of monitoring for unauthorized usage of system tools. For businesses, this suggests that technical controls surrounding command-line access and privilege management are critical in mitigating the impact of modern, cross-platform infostealers.