ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data

ClickFix Attacks Deliver Go-Based macOS Infostealer (TL-2026-1936) is a high-severity malware campaign, first published 2026-08-07. It has no confirmed attribution, affects Apple macOS, maps to 15 MITRE ATT&CK techniques (T1005, T1027.002, T1033), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-1936

Threat ID
TL-2026-1936
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-07
Last reviewed
2026-08-07
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
cryptocurrency
Detection rules
9
Indicators of compromise
16

Malware and tooling in ClickFix Attacks Deliver Go-Based macOS Infostealer

Malware and tooling: Go-based macOS crypto-drainer (DRAIN routine)

A ClickFix social-engineering campaign lures macOS users into pasting a Terminal command from a fake CAPTCHA/verification page, triggering a Bash loader that fetches an architecture-matched Go-compiled Mach-O stealer. The malware harvests browser passwords, iCloud Keychain data, and cached credentials, and includes a 'DRAIN' routine that partially or fully redirects Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP wallet balances to attacker-controlled addresses, with staging and C2 infrastructure traced to the OFAC/UK-sanctioned Russian bulletproof hosting provider Aeza Group (AS210644).

How ClickFix Attacks Deliver Go-Based macOS Infostealer works

Huntress researcher Andrew Brandt disclosed a ClickFix campaign that compromises macOS systems through a fake CAPTCHA/verification page instructing victims to paste and run a Terminal command. The pasted one-liner clears shell history in the same breath it executes, then downloads a Bash script (SHA256 5bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52) that profiles the host via ioreg, system_profiler, whoami, and uname -m before staging a directory that masquerades as Apple's trustd cache ($HOME/Library/Caches/com.apple.trustd) and retrieving an architecture-matched Mach-O payload written to disk as "com.apple.verified."

The dropped Go binary (ARM64 SHA256 f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0; x86_64 SHA256 619a99ba4ee9d7f33db8045c7e03c4265424977993fe8a53b0f45157c5abd3e5) strips extended attributes and is ad-hoc signed to reduce Gatekeeper friction, then uses osascript to display a fake "unexpected system error" dialog that harvests the user's macOS login password. It scrapes Chrome/Firefox/Safari password stores, iCloud Keychain entries via legitimate system APIs, and cached browser credentials/cookies. Its signature capability is a DRAIN routine, unique among the crypto stealers Huntress has analyzed: rather than emptying a wallet outright, it checks Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP balances and redirects a configurable percentage (observed near 1%) to an attacker-controlled address, reducing the odds of immediate victim detection. Persistence is established by copying a second payload to $HOME/Library/Caches/com.apple.softwareupdate/SoftwareUpdate (SHA256 b43a909a01e954d6549558f2f7e9bb58e34959a0ae229f340d61091ab726bbd3) and registering it as a LaunchAgent via `launchctl bootstrap gui/501 .../com.apple.softwareupdated.plist`, using Background Task Management to blend in with legitimate Apple update tooling.

Both the payload-staging server and the C2 endpoint are hosted on infrastructure in AS210644, operated by Aeza Group -- a St. Petersburg bulletproof hosting provider sanctioned by U.S. OFAC on 2025-07-01 and by the UK on 2025-11-19 for supplying infrastructure to ransomware and infostealer operators including Meduza, Lumma, RedLine, and BianLian. Huntress found this specific compromise during a retrospective threat hunt in June 2026 on a Mac breached roughly three months earlier, and no BeaconBeagle correlation currently exists for the three observed IPs (193.29.224.151, 77.221.152.34, 138.124.118.69), consistent with bespoke, low-reuse bulletproof-hosted infrastructure. No CVE is associated with this campaign -- compromise depends entirely on the victim manually executing the pasted command, not on a software vulnerability. Apple's forthcoming macOS 27 adds a warning when Terminal receives a paste from an external source, but the warning remains user-overridable.

MITRE ATT&CK techniques used in TL-2026-1936

Collection

T1005 Data from Local System

Defense Evasion

T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Credential Access

T1056.002 GUI Input Capture; T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers

Execution

T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste

Persistence

T1543.001 Launch Agent

defense-impairment

T1553.001 Gatekeeper Bypass

Initial Access

T1566.002 Spearphishing Link

Impact

T1657 Financial Theft

Affected products and versions in ClickFix Attacks Deliver Go-Based macOS Infostealer

  • Apple — macOS
    Vulnerable versions: macOS (Intel x86_64, versions prior to macOS 27); macOS (Apple Silicon ARM64, versions prior to macOS 27)
    Fixed in: macOS 27 (adds a Terminal external-paste warning; user-overridable, not a full block)

Remediation for ClickFix Attacks Deliver Go-Based macOS Infostealer

Immediate actions

  • Block outbound connections to Aeza Group AS210644 IPs 193.29.224.151, 77.221.152.34, and 138.124.118.69 at the network perimeter
  • Sinkhole/block the ClickFix staging domain profitnow[.]io at DNS and web proxy
  • Hunt endpoints for $HOME/Library/Caches/com.apple.trustd, $HOME/Library/Caches/com.apple.softwareupdate/SoftwareUpdate, and the LaunchAgent com.apple.softwareupdated.plist
  • Sweep EDR/AV telemetry for the four published SHA256 hashes
  • Instruct users to never paste and execute Terminal commands presented by a CAPTCHA/verification page, regardless of how legitimate it appears

Workarounds

  • Restrict non-admin users from creating/loading LaunchAgents via MDM configuration profiles
  • Disable or monitor Terminal.app usage via endpoint policy on high-risk user groups

Longer-term hardening

  • Deploy macOS EDR with behavioral detection for LaunchAgent creation, xattr quarantine-attribute removal, and osascript-triggered credential dialogs
  • Upgrade managed fleets to macOS 27 for the built-in Terminal external-paste warning
  • Enforce Gatekeeper/notarization strict-mode via MDM on managed macOS endpoints
  • Move high-value cryptocurrency holdings to hardware-wallet signing rather than browser/desktop hot wallets

Timeline of ClickFix Attacks Deliver Go-Based macOS Infostealer

  • U.S. Treasury OFAC sanctions Aeza Group, CEO Arsenii Penzev, and affiliated leaders for bulletproof hosting supporting ransomware/infostealer operators including Meduza, Lumma, RedLine, and BianLian.
  • The UK National Crime Agency sanctions Aeza Group, reinforcing the earlier U.S. OFAC action.
  • Approximate initial compromise of the Mac later examined by Huntress, per Huntress's estimate of roughly three months before its June 2026 retrospective threat hunt.
  • Huntress conducts a retrospective threat hunt and discovers the ClickFix-delivered Go-based macOS stealer on a client endpoint.
  • BleepingComputer publishes technical coverage including the ClickFix lure command and Aeza Group AS210644 attribution.
  • AppleInsider covers the campaign and notes macOS 27's new Terminal external-paste warning as a partial mitigation.
  • Huntress researcher Andrew Brandt publishes "Wallet-depleting macOS malware wants your crypto," detailing the DRAIN routine and Aeza Group infrastructure attribution.
  • TL-Intel Harness HUNT phase ingests the report and opens TL-2026-1936.
  • The Hacker News publishes coverage of the campaign, cited as the source feed for this threat record.

Sources cited for ClickFix Attacks Deliver Go-Based macOS Infostealer

Threats related to ClickFix Attacks Deliver Go-Based macOS Infostealer

Detection coverage for TL-2026-1936

As of 2026-08-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1936 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats