A Go-based infostealer delivered via ClickFix social engineering attacks is targeting macOS users to steal cryptocurrency, browser passwords, Apple Keychain data, and cached credentials. Discovered by Huntress MDR researchers, the malware arrives via a Terminal command prompted by a phishing email, downloads a Bash profiler/loader, and drops a Mach-O payload disguised as a macOS system process. It bypasses Gatekeeper by stripping the quarantine attribute and gains persistence using a fake osascript error dialog to harvest credentials. Uniquely, the crypto-draining component can redirect a configurable percentage of funds rather than emptying wallets entirely, targeting Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP. The malware communicates with infrastructure operated by Aeza Group, a Russian bulletproof hosting provider sanctioned by the US and UK for supporting ransomware operations.
Table of contents
Related Articles:Questions this post answers
How does the ClickFix macOS infostealer bypass Gatekeeper?
The malware removes the com.apple.quarantine extended attribute from the payload file, preventing Gatekeeper from treating it as quarantined and suppressing the security alert that would normally appear on execution. The payload is also disguised by placing it in a directory named after trustd, the legitimate macOS process for validating cryptographic certificates. macOS defenders tracking Gatekeeper bypass techniques find the latest evasion research on daily.dev.
Which cryptocurrencies does the Huntress-discovered macOS crypto drainer target?
The malware targets Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP. Unusually, it can be configured to redirect only a percentage of funds rather than draining wallets entirely, with separate functions calculating the value of 1% of wallet contents per cryptocurrency type. Teams defending crypto-handling environments stay ahead of drainer techniques on daily.dev.