# ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data

> A ClickFix social-engineering campaign lures macOS users into pasting a Terminal command from a fake CAPTCHA/verification page, triggering a Bash loader that fetches an architecture-matched Go-compiled Mach-O stealer. The malware harvests browser passwords, iCloud Keychain data, and cached credentials, and includes a 'DRAIN' routine that partially or fully redirects Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP wallet balances to attacker-controlled addresses, with staging and C2 infrastructure traced to the OFAC/UK-sanctioned Russian bulletproof hosting provider Aeza Group (AS210644).

- **Published:** 2026-08-07T00:00:00Z
- **Last reviewed:** 2026-08-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1936
- **ID:** TL-2026-1936
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Huntress researcher Andrew Brandt disclosed a ClickFix campaign that compromises macOS systems through a fake CAPTCHA/verification page instructing victims to paste and run a Terminal command. The pasted one-liner clears shell history in the same breath it executes, then downloads a Bash script (SHA256 5bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52) that profiles the host via ioreg, system_profiler, whoami, and uname -m before staging a directory that masquerades as Apple's trustd cache ($HOME/Library/Caches/com.apple.trustd) and retrieving an architecture-matched Mach-O payload written to disk as "com.apple.verified."

The dropped Go binary (ARM64 SHA256 f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0; x86_64 SHA256 619a99ba4ee9d7f33db8045c7e03c4265424977993fe8a53b0f45157c5abd3e5) strips extended attributes and is ad-hoc signed to reduce Gatekeeper friction, then uses osascript to display a fake "unexpected system error" dialog that harvests the user's macOS login password. It scrapes Chrome/Firefox/Safari password stores, iCloud Keychain entries via legitimate system APIs, and cached browser credentials/cookies. Its signature capability is a DRAIN routine, unique among the crypto stealers Huntress has analyzed: rather than emptying a wallet outright, it checks Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP balances and redirects a configurable percentage (observed near 1%) to an attacker-controlled address, reducing the odds of immediate victim detection. Persistence is established by copying a second payload to $HOME/Library/Caches/com.apple.softwareupdate/SoftwareUpdate (SHA256 b43a909a01e954d6549558f2f7e9bb58e34959a0ae229f340d61091ab726bbd3) and registering it as a LaunchAgent via `launchctl bootstrap gui/501 .../com.apple.softwareupdated.plist`, using Background Task Management to blend in with legitimate Apple update tooling.

Both the payload-staging server and the C2 endpoint are hosted on infrastructure in AS210644, operated by Aeza Group -- a St. Petersburg bulletproof hosting provider sanctioned by U.S. OFAC on 2025-07-01 and by the UK on 2025-11-19 for supplying infrastructure to ransomware and infostealer operators including Meduza, Lumma, RedLine, and BianLian. Huntress found this specific compromise during a retrospective threat hunt in June 2026 on a Mac breached roughly three months earlier, and no BeaconBeagle correlation currently exists for the three observed IPs (193.29.224.151, 77.221.152.34, 138.124.118.69), consistent with bespoke, low-reuse bulletproof-hosted infrastructure. No CVE is associated with this campaign -- compromise depends entirely on the victim manually executing the pasted command, not on a software vulnerability. Apple's forthcoming macOS 27 adds a warning when Terminal receives a paste from an external source, but the warning remains user-overridable.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1027.002 Software Packing
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.002 GUI Input Capture
- T1543.001 Launch Agent
- T1036.005 Match Legitimate Resource Name or Location
- T1553.001 Gatekeeper Bypass
- T1005 Data from Local System
- T1657 Financial Theft
- T1082 System Information Discovery
- T1033 System Owner/User Discovery

## Sources

- [ClickFix attacks deliver macOS stealer](https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html)
- [Wallet-depleting macOS malware wants your crypto](https://www.huntress.com/blog/mac-crypto-draining-malware)
- [ClickFix attack pushes macOS infostealer for crypto theft attacks](https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/)
- [One pasted Terminal command opens the door to Mac crypto wallet theft](https://appleinsider.com/articles/26/08/06/one-pasted-terminal-command-opens-the-door-to-mac-crypto-wallet-theft)
- [Russian bulletproof hosting service Aeza Group sanctioned by US for ransomware work](https://therecord.media/russia-bulletproof-hosting-aeza-group-us-sanctions)
- [Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft](https://home.treasury.gov/news/press-releases/sb0185)
- [Huntress, Microsoft Detail the Continued Popularity, Evolution of ClickFix Attacks](https://securityboulevard.com/2026/02/huntress-microsoft-detail-the-continued-popularity-evolution-of-clickfix-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1936