ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials
ClickFix Attack Delivers Go-Based macOS Infostealer (TL-2026-1920) is a high-severity malware campaign, first published 2026-08-06. It has no confirmed attribution, affects Apple macOS, maps to 17 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-1920
- Threat ID
- TL-2026-1920
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-06
- Last reviewed
- 2026-08-06
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, finance, technology
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in ClickFix Attack Delivers Go-Based macOS Infostealer
Malware and tooling: garble
A Go-based macOS infostealer and cryptocurrency wallet drainer is being delivered via ClickFix social-engineering attacks. The malware steals browser passwords, Apple Keychain data, cached credentials, and browser cookies, and intercepts cryptocurrency transactions using a novel selective-draining technique configurable to steal a configurable percentage rather than the full wallet balance. C2 infrastructure is hosted on Aeza Group (AS 210644), a Russian bulletproof hosting provider sanctioned by the US, UK, and Australia. The campaign was discovered by Huntress during a retrospective threat hunt in June 2026.
How ClickFix Attack Delivers Go-Based macOS Infostealer works
Huntress researchers identified this Go-based macOS infostealer and cryptocurrency drainer during a retrospective incident response threat hunt in June 2026, finding an infection that had been present for approximately three months. The attack chain begins with a phishing email containing a link to a webpage that instructs the victim to paste and execute a command in macOS Terminal as part of a ClickFix social-engineering scheme, often disguised as a CAPTCHA or error message.
The executed command downloads a Bash profiler/loader script that performs system profiling via ioreg and system_profiler to identify the CPU architecture (ARM64 for Apple Silicon or x86_64 for Intel), then downloads the appropriate Mach-O executable variant. The malware creates a directory at $HOME/Library/Caches/com.apple.trustd/ to masquerade as Apple's legitimate certificate trust evaluation daemon and drops the executable as com.apple.verified. The quarantine extended attribute is stripped via xattr -d com.apple.quarantine to suppress Gatekeeper warnings, though this is redundant since curl does not set the quarantine flag. After execution, the malware deletes its temporary files, clears the Terminal window, and removes the command from shell history.
The Go-based payload, compiled using the garble obfuscation tool to encrypt plaintext strings and mangle function names, has three primary capabilities. First, credential theft: it scrapes browser password databases (Chrome, Safari, Edge, Firefox, and other Chromium derivatives), Apple Keychain data, and cached browser cookies from specific filesystem locations. Second, privilege escalation: it uses osascript to display a native-looking macOS dialog box to phish for the user's administrator password. Third, cryptocurrency wallet draining: a dedicated DRAIN function scans for cryptocurrency wallet addresses, queries blockchains for balances, and transfers funds to attacker-controlled wallets. Notably, the DRAIN_PCT variable controls whether the full balance or a percentage is stolen by calculating per-cryptocurrency 1% values, a technique Huntress had not previously observed.
Persistence is established via launchctl bootstrap gui/501 registering a LaunchAgent at ~/Library/LaunchAgents/com.apple.softwareupdated.plist, which executes a payload disguised as SoftwareUpdate at ~/Library/Caches/com.apple.softwareupdate/SoftwareUpdate. The malware integrates into Apple's Background Task Management (BTM) subsystem.
C2 communication occurs over HTTP to IP 138.124.118.69 on non-standard port 8133. All attack infrastructure (payload hosting, script hosting, C2) traces to IP addresses within Autonomous System AS 210644, operated by Aeza Group LLC (St. Petersburg, Russia), a commercial bulletproof hosting provider sanctioned by the US OFAC in July 2025 and by the UK and Australia in November 2025 for knowingly hosting ransomware groups (BianLian), infostealer operations (Meduza, Lumma, RedLine), and darknet marketplaces (BlackSprut).
Targeted cryptocurrencies include Bitcoin, Litecoin, Dogecoin, Ethereum, and Ripple XRP with dedicated drain subroutines, and Monero referenced in code without a confirmed drain routine. Wallet addresses embedded in the analyzed sample had zero transactions at time of analysis, suggesting the campaign may have been in early stages or these were test wallets.
MITRE ATT&CK techniques used in TL-2026-1920
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.003 Clear Command History; T1070.004 File Deletion
Credential Access
T1056.002 GUI Input Capture; T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Execution
T1059.004 Unix Shell; T1204.002 Malicious File
Command and Control
Discovery
T1082 System Information Discovery
Impact
Persistence
Initial Access
defense-impairment
Affected products and versions in ClickFix Attack Delivers Go-Based macOS Infostealer
- Apple — macOS
Vulnerable versions: All versions prior to macOS 27 security updates
Fixed in: macOS 27+ with improved paste-from-website warnings and XProtect signatures - Multiple — Chromium-based browsers
Vulnerable versions: Chrome, Brave, Edge, Opera, Vivaldi, Arc — all versions with saved passwords - Mozilla — Firefox
Vulnerable versions: All versions with saved passwords or cookies - Multiple — Cryptocurrency wallets
Vulnerable versions: Bitcoin, Ethereum, Litecoin, Dogecoin, XRP, and Monero wallets with exposed addresses
Remediation for ClickFix Attack Delivers Go-Based macOS Infostealer
Immediate actions
- Disconnect infected Mac from network to prevent further C2 communication and exfiltration
- Change all passwords from a trusted, uncompromised device
- Rotate cryptocurrency wallet private keys and recovery phrases if exposure suspected
- Run a full malware scan with updated EDR/AV solutions
- Check for LaunchAgents in ~/Library/LaunchAgents/ matching com.apple.softwareupdated.plist
Workarounds
- macOS 27 includes a paste-from-website warning — ensure all users are on latest macOS version
- Restrict execution of unsigned binaries in ~/Library/Caches/ via macOS security policies
- Disable automatic Terminal command execution from browser-launched applications
Longer-term hardening
- Deploy EDR with behavioral detection for osascript, launchctl bootstrap, and xattr usage anomalies
- Implement application allowlisting to block unsigned Mach-O binaries in cache directories
- Monitor for anomalous outbound HTTP connections on non-standard ports from macOS endpoints
- Educate users on ClickFix social engineering — no legitimate service requests Terminal command execution
Timeline of ClickFix Attack Delivers Go-Based macOS Infostealer
- Earliest evidence of infection based on Huntress retrospective analysis of a compromised Mac found during June threat hunt; infection had been present approximately three months
- Microsoft Security publishes report on ClickFix campaign using fake macOS utility lures delivering Macsync, Shub Stealer, and AMOS via fake blog posts on Medium and Squarespace
- Huntress researchers discover the Go-based macOS infostealer/crypto drainer during a retrospective incident response threat hunt on a monitored system
- Guard.io reports 'GoogleFix' evolution of ClickFix, with malicious ads hijacking Google sponsored results to deliver AMOS stealer
- Palo Alto Networks Unit 42 publishes intelligence on macOS ClickFix campaign delivering backdoors via fake CAPTCHA pages with LaunchAgent persistence
- BleepingComputer and AppleInsider publish coverage of the campaign, detailing the ClickFix delivery mechanism, DRAIN function, and Aeza Group C2 infrastructure
- Huntress publishes full technical analysis and IOCs for the Go-based macOS infostealer/crypto drainer with DRAIN_PCT selective-draining capability
Sources cited for ClickFix Attack Delivers Go-Based macOS Infostealer
- Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam
- ClickFix attack pushes macOS infostealer for crypto theft attacks
- One pasted Terminal command opens the door to Mac crypto wallet theft
- ClickFix campaign uses fake macOS utilities lures to deliver infostealers
- ClickLock Stealer: New macOS malware distributed via ClickFix
- U.S. Treasury Sanctions Bulletproof Hosting Provider Aeza Group
- macOS ClickFix Campaign Delivering Backdoors via Fake CAPTCHA Pages
- ClickFix macOS Infostealer: Evil Evolution
- GoogleFix — ClickFix's Latest Evolution Hijacks Google Sponsored Results with AMOS Stealer Lures
- OFAC Designation of Aeza Group Entities and Individuals
Threats related to ClickFix Attack Delivers Go-Based macOS Infostealer
- ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data
- Go-Based macOS Stealer Uses ClickFix Lures to Drain Cryptocurrency Wallets (Aeza Group Infrastructure)
- macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync Infostealers
- Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate
- Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign
- CrashStealer: Notarized Fake Apple CrashReporter App Steals macOS Keychain, Browser, and Crypto Wallet Credentials
Detection coverage for TL-2026-1920
As of 2026-08-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1920 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.