ClickFix Attacks Deploy macOS Crypto-Draining Stealer
A new wave of ClickFix-style social engineering attacks is delivering a Go-based macOS stealer engineered to silently siphon funds from cryptocurrency wallets while harvesting browser passwords, iCloud Keychain data, and cached credentials. According to Huntress security researcher Andrew Brandt, the infection chain begins when a victim pastes a malicious ClickFix command into the macOS Terminal, triggering a Bash profiler that fingerprints the host's CPU architecture before pulling the matching Mach-O payload. Once executed, the malware escalates privileges by presenting a fake system error prompt that tricks users into surrendering their credentials under the pretense of restoring damaged files.
What sets this campaign apart is a dedicated "DRAIN" routine tailored to six major cryptocurrencies: Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP. Rather than simply exfiltrating wallet contents wholesale, the malware calculates partial withdrawals—including a function that determines the dollar value of exactly 1% of the wallet's holdings—enabling it to drain funds incrementally without raising immediate suspicion. Users concerned about credential exposure can verify whether their browser-saved passwords have appeared in known dumps using an online password checker, while those worried about compromised email logins tied to Apple IDs can search an email breach lookup tool.
The command-and-control (C2) server hosting the payloads traces back to Aeza Group, a Russian bulletproof hosting provider recently sanctioned by the U.S., U.K., and Australia for enabling cybercrime operations. The disclosure arrives amid a broader surge in ClickFix activity, including a separate macOS campaign distributing MacSync and Atomic Stealer via look-alike domains with server-side browser fingerprinting that filters out bots, sandboxes, and non-Mac visitors. Security teams defending against similar threats can audit exposure by running a browser fingerprint test to understand what device signals their endpoints leak during web sessions.