ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials — Threadlinqs Intelligence
As of 2026-08-06, ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials is a high-severity malware threat attributed to Unattributed Cybercriminal Group, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1920 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Unattributed Cybercriminal Group · FINANCIAL
A Go-based macOS infostealer and cryptocurrency wallet drainer is being delivered via ClickFix social-engineering attacks. The malware steals browser passwords, Apple Keychain data, cached
Huntress researchers identified this Go-based macOS infostealer and cryptocurrency drainer during a retrospective incident response threat hunt in June 2026, finding an infection that had been present for approximately three months. The attack chain begins with a phishing email containing a link to a webpage that instructs the victim to paste and execute a command in macOS Terminal as part of a ClickFix social-engineering scheme, often disguised as a CAPTCHA or error message.
The executed command downloads a Bash profiler/loader script that performs system profiling via ioreg and system_profiler to identify the CPU architecture (ARM64 for Apple Silicon or x86_64 for Intel), then downloads the appropriate Mach-O executable variant. The malware creates a directory at $HOME/Library/Caches/com.apple.trustd/ to masquerade as Apple's legitimate certificate trust evaluation daemon and drops the executable as com.apple.verified. The quarantine extended attribute is stripped via xattr -d com.apple.quarantine to suppress Gatekeeper warnings, though this is redundant since curl does not set the quarantine flag. After execution, the malware deletes its temporary files, clears the Terminal window, and removes the command from shell history.
The Go-based payload, compiled using the garble obfuscation tool to encrypt plaintext strings and mangle function names, has three primary capabilities. First, credential theft: it scrapes browser password databases (Chrome, Safari, Edge, Firefox, and other Chromium derivatives), Apple Keychain data, and cached browser cookies from specific filesystem locations. Second, privilege escalation: it uses osascript to display a native-looking macOS dialog box to phish for the user's administrator password. Third, cryptocurrency wallet draining: a dedicated DRAIN function scans for cryptocurrency wallet addresses, queries blockchains for balances, and transfers funds to attacker-controlled wallets. Notably, the DRAIN_PCT variable controls whether the full balance or a percentage is stolen by calculating per-cryptocurrency 1% values, a technique Huntress had not previously observed.
Persistence is established via launchctl bootstrap gui/501 registering a LaunchAgent at ~/Library/LaunchAgents/com.apple.softwareupdated.plist, which executes a payload disguised as SoftwareUpdate at ~/Library/Caches/com.apple.softwareupdate/SoftwareUpdate. The malware integrates into Apple's Background Task Management (BTM) subsystem.
C2 communication occurs over HTTP to IP 138.124.118.69 on non-standard port 8133. All attack infrastructure (payload hosting, script hosting, C2) traces to IP addresses within Autonomous System AS 210644, operated by Aeza Group LLC (St. Petersburg, Russia), a commercial bulletproof hosting provider sanctioned by the US OFAC in July 2025 and by the UK and Australia in November 2025 for knowingly hosting ransomware groups (BianLian), infostealer operations (Meduza, Lumma, RedLine), and darknet marketplaces (BlackSprut).
Targeted cryptocurrencies include Bitcoin, Litecoin, Dogecoin, Ethereum, and Ripple XRP with dedicated drain subroutines, and Monero referenced in code without a confirmed drain routine. Wallet addresses embedded in the analyzed sample had zero transactions at time of analysis, suggesting the campaign may have been in early stages or these were test wallets.
Target sectors: cryptocurrency, finance, technology
Target regions: North America, Europe
Timeline
- Earliest evidence of infection based on Huntress retrospective analysis of a compromised Mac found during June threat hunt; infection had been present approximately three months
- Microsoft Security publishes report on ClickFix campaign using fake macOS utility lures delivering Macsync, Shub Stealer, and AMOS via fake blog posts on Medium and Squarespace
- Huntress researchers discover the Go-based macOS infostealer/crypto drainer during a retrospective incident response threat hunt on a monitored system
- Guard.io reports 'GoogleFix' evolution of ClickFix, with malicious ads hijacking Google sponsored results to deliver AMOS stealer
- Palo Alto Networks Unit 42 publishes intelligence on macOS ClickFix campaign delivering backdoors via fake CAPTCHA pages with LaunchAgent persistence
- Huntress publishes full technical analysis and IOCs for the Go-based macOS infostealer/crypto drainer with DRAIN_PCT selective-draining capability
- BleepingComputer and AppleInsider publish coverage of the campaign, detailing the ClickFix delivery mechanism, DRAIN function, and Aeza Group C2 infrastructure
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.002, T1204.002, T1059.004, T1543.001, T1036.005, T1685, T1070.003, T1070.004, T1027, T1056.002
