ClickFix Attack Delivers macOS Crypto Drainer That Steals Wallet Funds

A new ClickFix campaign targets macOS users with malware that steals cryptocurrency, browser passwords, Apple Keychain data and cached credentials.

Huntress discovered the threat while responding to a ClickFix incident. Researchers say the Go-based malware can intercept cryptocurrency transfers and redirect funds before victims approve their transactions.

Unlike many wallet-draining tools, this macOS crypto drainer does not always empty an account. Attackers can configure it to divert only part of a transaction or calculate how much value to take.

ClickFix lure tells victims to use Terminal

The attack starts with an email that directs the target to a malicious webpage. That page tells the user to open Terminal and run a command.

ClickFix campaigns commonly rely on this tactic. Rather than exploiting a software flaw, attackers convince victims to copy and run commands themselves.

The command downloads a Bash script that collects basic system details, including the computer’s CPU and memory. It then retrieves a Mach-O malware payload that matches the Mac’s processor architecture.

Next, the script identifies the currently logged-in account and creates a directory with a name that resembles trustd. Trustd is a legitimate macOS process that validates cryptographic certificates and code signatures.

The loader copies its payload into that directory under the name com.apple.verified. It also removes the quarantine attribute that macOS normally applies to downloaded files. By doing so, the malware aims to prevent Gatekeeper from showing a security warning when the victim runs it.

Malware steals credentials and targets wallets

Huntress says the malware establishes persistence and seeks higher privileges by displaying a fake macOS error prompt. The prompt asks the victim to enter an administrator password.

Once it gains access, the stealer searches the device for credential-related files. It specifically targets browser password databases, Apple Keychain information and authentication data stored in browser cookies.

The malware also includes code that modifies cryptocurrency transactions before the user signs them. It can redirect Bitcoin, Litecoin, Dogecoin, Monero, Ethereum and XRP transfers to attacker-controlled wallets.

Researchers found that the tool can calculate the value of a percentage of the victim’s wallet holdings. That ability gives operators more flexibility than a typical crypto drainer, which often attempts to take every available asset.

A smaller or percentage-based theft may attract less attention and make the fraudulent transaction harder for a victim to notice immediately.

Huntress links infrastructure to sanctioned provider

The malware communicates with shared IP addresses in Autonomous System 210644, according to Huntress.

Aeza Group, a Russian corporation, operates the network, the researchers said. The United States and United Kingdom have sanctioned the company and several affiliated individuals for allegedly providing bulletproof hosting services to ransomware groups.

Mac users should treat unexpected instructions to run Terminal commands as a major warning sign. Legitimate companies do not normally ask customers to paste commands into Terminal to fix an issue, verify an account or complete a security check.

Keeping macOS updated, using strong account protections and reviewing every cryptocurrency transaction before signing can reduce the risk from this macOS crypto drainer.