ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data
ClickFix Attacks Deliver Go-Based macOS Infostealer (TL-2026-1936) is a high-severity malware campaign, first published 2026-08-07. It has no confirmed attribution, affects Apple macOS, maps to 15 MITRE ATT&CK techniques (T1005, T1027.002, T1033), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-1936
- Threat ID
- TL-2026-1936
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-07
- Last reviewed
- 2026-08-07
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in ClickFix Attacks Deliver Go-Based macOS Infostealer
Malware and tooling: Go-based macOS crypto-drainer (DRAIN routine)
A ClickFix social-engineering campaign lures macOS users into pasting a Terminal command from a fake CAPTCHA/verification page, triggering a Bash loader that fetches an architecture-matched Go-compiled Mach-O stealer. The malware harvests browser passwords, iCloud Keychain data, and cached credentials, and includes a 'DRAIN' routine that partially or fully redirects Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP wallet balances to attacker-controlled addresses, with staging and C2 infrastructure traced to the OFAC/UK-sanctioned Russian bulletproof hosting provider Aeza Group (AS210644).
How ClickFix Attacks Deliver Go-Based macOS Infostealer works
Huntress researcher Andrew Brandt disclosed a ClickFix campaign that compromises macOS systems through a fake CAPTCHA/verification page instructing victims to paste and run a Terminal command. The pasted one-liner clears shell history in the same breath it executes, then downloads a Bash script (SHA256 5bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52) that profiles the host via ioreg, system_profiler, whoami, and uname -m before staging a directory that masquerades as Apple's trustd cache ($HOME/Library/Caches/com.apple.trustd) and retrieving an architecture-matched Mach-O payload written to disk as "com.apple.verified."
The dropped Go binary (ARM64 SHA256 f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0; x86_64 SHA256 619a99ba4ee9d7f33db8045c7e03c4265424977993fe8a53b0f45157c5abd3e5) strips extended attributes and is ad-hoc signed to reduce Gatekeeper friction, then uses osascript to display a fake "unexpected system error" dialog that harvests the user's macOS login password. It scrapes Chrome/Firefox/Safari password stores, iCloud Keychain entries via legitimate system APIs, and cached browser credentials/cookies. Its signature capability is a DRAIN routine, unique among the crypto stealers Huntress has analyzed: rather than emptying a wallet outright, it checks Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP balances and redirects a configurable percentage (observed near 1%) to an attacker-controlled address, reducing the odds of immediate victim detection. Persistence is established by copying a second payload to $HOME/Library/Caches/com.apple.softwareupdate/SoftwareUpdate (SHA256 b43a909a01e954d6549558f2f7e9bb58e34959a0ae229f340d61091ab726bbd3) and registering it as a LaunchAgent via `launchctl bootstrap gui/501 .../com.apple.softwareupdated.plist`, using Background Task Management to blend in with legitimate Apple update tooling.
Both the payload-staging server and the C2 endpoint are hosted on infrastructure in AS210644, operated by Aeza Group -- a St. Petersburg bulletproof hosting provider sanctioned by U.S. OFAC on 2025-07-01 and by the UK on 2025-11-19 for supplying infrastructure to ransomware and infostealer operators including Meduza, Lumma, RedLine, and BianLian. Huntress found this specific compromise during a retrospective threat hunt in June 2026 on a Mac breached roughly three months earlier, and no BeaconBeagle correlation currently exists for the three observed IPs (193.29.224.151, 77.221.152.34, 138.124.118.69), consistent with bespoke, low-reuse bulletproof-hosted infrastructure. No CVE is associated with this campaign -- compromise depends entirely on the victim manually executing the pasted command, not on a software vulnerability. Apple's forthcoming macOS 27 adds a warning when Terminal receives a paste from an external source, but the warning remains user-overridable.
MITRE ATT&CK techniques used in TL-2026-1936
Collection
Defense Evasion
T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery
Credential Access
T1056.002 GUI Input Capture; T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Execution
T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste
Persistence
defense-impairment
Initial Access
Impact
Affected products and versions in ClickFix Attacks Deliver Go-Based macOS Infostealer
- Apple — macOS
Vulnerable versions: macOS (Intel x86_64, versions prior to macOS 27); macOS (Apple Silicon ARM64, versions prior to macOS 27)
Fixed in: macOS 27 (adds a Terminal external-paste warning; user-overridable, not a full block)
Remediation for ClickFix Attacks Deliver Go-Based macOS Infostealer
Immediate actions
- Block outbound connections to Aeza Group AS210644 IPs 193.29.224.151, 77.221.152.34, and 138.124.118.69 at the network perimeter
- Sinkhole/block the ClickFix staging domain profitnow[.]io at DNS and web proxy
- Hunt endpoints for $HOME/Library/Caches/com.apple.trustd, $HOME/Library/Caches/com.apple.softwareupdate/SoftwareUpdate, and the LaunchAgent com.apple.softwareupdated.plist
- Sweep EDR/AV telemetry for the four published SHA256 hashes
- Instruct users to never paste and execute Terminal commands presented by a CAPTCHA/verification page, regardless of how legitimate it appears
Workarounds
- Restrict non-admin users from creating/loading LaunchAgents via MDM configuration profiles
- Disable or monitor Terminal.app usage via endpoint policy on high-risk user groups
Longer-term hardening
- Deploy macOS EDR with behavioral detection for LaunchAgent creation, xattr quarantine-attribute removal, and osascript-triggered credential dialogs
- Upgrade managed fleets to macOS 27 for the built-in Terminal external-paste warning
- Enforce Gatekeeper/notarization strict-mode via MDM on managed macOS endpoints
- Move high-value cryptocurrency holdings to hardware-wallet signing rather than browser/desktop hot wallets
Timeline of ClickFix Attacks Deliver Go-Based macOS Infostealer
- U.S. Treasury OFAC sanctions Aeza Group, CEO Arsenii Penzev, and affiliated leaders for bulletproof hosting supporting ransomware/infostealer operators including Meduza, Lumma, RedLine, and BianLian.
- The UK National Crime Agency sanctions Aeza Group, reinforcing the earlier U.S. OFAC action.
- Approximate initial compromise of the Mac later examined by Huntress, per Huntress's estimate of roughly three months before its June 2026 retrospective threat hunt.
- Huntress conducts a retrospective threat hunt and discovers the ClickFix-delivered Go-based macOS stealer on a client endpoint.
- BleepingComputer publishes technical coverage including the ClickFix lure command and Aeza Group AS210644 attribution.
- AppleInsider covers the campaign and notes macOS 27's new Terminal external-paste warning as a partial mitigation.
- Huntress researcher Andrew Brandt publishes "Wallet-depleting macOS malware wants your crypto," detailing the DRAIN routine and Aeza Group infrastructure attribution.
- TL-Intel Harness HUNT phase ingests the report and opens TL-2026-1936.
- The Hacker News publishes coverage of the campaign, cited as the source feed for this threat record.
Sources cited for ClickFix Attacks Deliver Go-Based macOS Infostealer
- ClickFix attacks deliver macOS stealer
- Wallet-depleting macOS malware wants your crypto
- ClickFix attack pushes macOS infostealer for crypto theft attacks
- One pasted Terminal command opens the door to Mac crypto wallet theft
- Russian bulletproof hosting service Aeza Group sanctioned by US for ransomware work
- Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft
- Huntress, Microsoft Detail the Continued Popularity, Evolution of ClickFix Attacks
Threats related to ClickFix Attacks Deliver Go-Based macOS Infostealer
- ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials
- Go-Based macOS Stealer Uses ClickFix Lures to Drain Cryptocurrency Wallets (Aeza Group Infrastructure)
- Meow Mac Stealer RAT: macOS ClickFix Lures Deploy AppleScript Infostealer with Persistent RAT Capabilities
- macOS ClickFix Campaign Silently Mounts Malicious DMGs (hdiutil attach -nobrowse) to Deploy Atomic macOS Stealer (AMOS)
- macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync Infostealers
- Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate
Detection coverage for TL-2026-1936
As of 2026-08-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1936 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.