# ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials

> A Go-based macOS infostealer and cryptocurrency wallet drainer is being delivered via ClickFix social-engineering attacks. The malware steals browser passwords, Apple Keychain data, cached credentials, and browser cookies, and intercepts cryptocurrency transactions using a novel selective-draining technique configurable to steal a configurable percentage rather than the full wallet balance. C2 infrastructure is hosted on Aeza Group (AS 210644), a Russian bulletproof hosting provider sanctioned by the US, UK, and Australia. The campaign was discovered by Huntress during a retrospective threat hunt in June 2026.

- **Published:** 2026-08-06T00:00:00Z
- **Last reviewed:** 2026-08-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1920
- **ID:** TL-2026-1920
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Huntress researchers identified this Go-based macOS infostealer and cryptocurrency drainer during a retrospective incident response threat hunt in June 2026, finding an infection that had been present for approximately three months. The attack chain begins with a phishing email containing a link to a webpage that instructs the victim to paste and execute a command in macOS Terminal as part of a ClickFix social-engineering scheme, often disguised as a CAPTCHA or error message.

The executed command downloads a Bash profiler/loader script that performs system profiling via ioreg and system_profiler to identify the CPU architecture (ARM64 for Apple Silicon or x86_64 for Intel), then downloads the appropriate Mach-O executable variant. The malware creates a directory at $HOME/Library/Caches/com.apple.trustd/ to masquerade as Apple's legitimate certificate trust evaluation daemon and drops the executable as com.apple.verified. The quarantine extended attribute is stripped via xattr -d com.apple.quarantine to suppress Gatekeeper warnings, though this is redundant since curl does not set the quarantine flag. After execution, the malware deletes its temporary files, clears the Terminal window, and removes the command from shell history.

The Go-based payload, compiled using the garble obfuscation tool to encrypt plaintext strings and mangle function names, has three primary capabilities. First, credential theft: it scrapes browser password databases (Chrome, Safari, Edge, Firefox, and other Chromium derivatives), Apple Keychain data, and cached browser cookies from specific filesystem locations. Second, privilege escalation: it uses osascript to display a native-looking macOS dialog box to phish for the user's administrator password. Third, cryptocurrency wallet draining: a dedicated DRAIN function scans for cryptocurrency wallet addresses, queries blockchains for balances, and transfers funds to attacker-controlled wallets. Notably, the DRAIN_PCT variable controls whether the full balance or a percentage is stolen by calculating per-cryptocurrency 1% values, a technique Huntress had not previously observed.

Persistence is established via launchctl bootstrap gui/501 registering a LaunchAgent at ~/Library/LaunchAgents/com.apple.softwareupdated.plist, which executes a payload disguised as SoftwareUpdate at ~/Library/Caches/com.apple.softwareupdate/SoftwareUpdate. The malware integrates into Apple's Background Task Management (BTM) subsystem.

C2 communication occurs over HTTP to IP 138.124.118.69 on non-standard port 8133. All attack infrastructure (payload hosting, script hosting, C2) traces to IP addresses within Autonomous System AS 210644, operated by Aeza Group LLC (St. Petersburg, Russia), a commercial bulletproof hosting provider sanctioned by the US OFAC in July 2025 and by the UK and Australia in November 2025 for knowingly hosting ransomware groups (BianLian), infostealer operations (Meduza, Lumma, RedLine), and darknet marketplaces (BlackSprut).

Targeted cryptocurrencies include Bitcoin, Litecoin, Dogecoin, Ethereum, and Ripple XRP with dedicated drain subroutines, and Monero referenced in code without a confirmed drain routine. Wallet addresses embedded in the analyzed sample had zero transactions at time of analysis, suggesting the campaign may have been in early stages or these were test wallets.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1543.001 Launch Agent
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1027 Obfuscated Files or Information
- T1056.002 GUI Input Capture
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1496 Resource Hijacking

## Sources

- [Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam](https://www.huntress.com/blog/mac-crypto-draining-malware)
- [ClickFix attack pushes macOS infostealer for crypto theft attacks](https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/)
- [One pasted Terminal command opens the door to Mac crypto wallet theft](https://appleinsider.com/articles/26/08/06/one-pasted-terminal-command-opens-the-door-to-mac-crypto-wallet-theft)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [ClickLock Stealer: New macOS malware distributed via ClickFix](https://www.group-ib.com/blog/clicklock-stealer-macos-malware/)
- [U.S. Treasury Sanctions Bulletproof Hosting Provider Aeza Group](https://home.treasury.gov/news/press-releases/sb0185)
- [macOS ClickFix Campaign Delivering Backdoors via Fake CAPTCHA Pages](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-07-08-macOS-ClickFix-campaign.txt)
- [ClickFix macOS Infostealer: Evil Evolution](https://www.sophos.com/en-us/blog/evil-evolution-clickfix-and-macos-infostealers)
- [GoogleFix — ClickFix's Latest Evolution Hijacks Google Sponsored Results with AMOS Stealer Lures](https://guard.io/labs/googlefix---clickfixs-latest-evolution-now-hijacks-googles-sponsored-results-infected-with-amos-stealer-lures)
- [OFAC Designation of Aeza Group Entities and Individuals](https://ofac.treasury.gov/recent-actions/20250701)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1920