--- title: Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam description: Huntress analyzed a macOS infection stemming from a ClickFix social engineering attack, where a victim was tricked into pasting a Terminal command from a fake... canonical: https://daily.dev/posts/mac-malware-drains-crypto-wallets-via-fake-captcha-scam-uljusbfph twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam | daily.dev og:description: Huntress analyzed a macOS infection stemming from a ClickFix social engineering attack, where a victim was tricked into pasting a Terminal command from a fake... og:url: https://daily.dev/posts/mac-malware-drains-crypto-wallets-via-fake-captcha-scam-uljusbfph og:image: https://api.daily.dev/og/posts/UljUsbFph.png og:image:alt: Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 10 min read · 0 upvotes · 0 comments ## Summary Huntress analyzed a macOS infection stemming from a ClickFix social engineering attack, where a victim was tricked into pasting a Terminal command from a fake CAPTCHA popup. The command chain downloaded a Go-based Mach-O stealer that harvests browser passwords, Apple Keychain data, and cached credentials, and includes a DRAIN function capable of detecting cryptocurrency wallet balances and siphoning a configurable percentage or all of the funds to attacker-controlled wallets. The malware achieved persistence by masquerading as system processes and used osascript prompts to phish elevated credentials. All infrastructure traced back to Aeza Group, a Russian bulletproof hosting provider sanctioned by the US, UK, and Australia. Mitigation recommendations include script-blocking browser extensions, DNS blackholes, and user education against ClickFix popups. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is a ClickFix attack and how does it infect a Mac through the Terminal? A ClickFix attack presents a fake CAPTCHA popup instructing the user to copy a command and paste it into Terminal. On one observed macOS infection, the pasted command downloaded a Bash profiler/loader from an attacker-controlled IP, which fetched a Mach-O payload matched to the CPU architecture, cleared Terminal history, and installed a Go-based stealer targeting Keychain and browser credentials. _Security teams tracking social engineering tactics like ClickFix can follow emerging threat writeups on daily.dev._ ### How does the DRAIN function in Mac crypto-stealing malware decide how much of a wallet to steal? A DRAIN_PCT variable controls what percentage of a cryptocurrency wallet's balance gets siphoned rather than emptying it entirely. The malware calculates the value of 1% of the wallet's holdings per cryptocurrency, then has separate subroutines for Bitcoin, Litecoin, Dogecoin, Ethereum, and XRP to transfer the calculated portion to attacker-controlled wallets, leaving the victim the remainder. _Developers building wallet security tooling can track emerging crypto-drainer techniques on daily.dev._ ### How did the Mac stealer malware achieve persistence and avoid macOS Gatekeeper warnings? The malware disguised itself using filenames mimicking legitimate Apple processes, such as com.apple.trustd and com.apple.softwareupdate, and registered itself via launchctl bootstrap into the Background Task Management subsystem. It stripped the quarantine extended attribute with xattr to bypass Gatekeeper warnings, and used an osascript dialog to phish the victim's password for elevated privileges. _Mac admins hardening endpoint defenses can keep up with these persistence tricks via daily.dev._ ## Similar posts on daily.dev - [New macOS ClickFix attack silently mounts DMGs to push infostealer](https://daily.dev/posts/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer-tp3l5rbe7) · BleepingComputer · 0 upvotes · 0 comments - [Fake Cloudflare CAPTCHA tricks victims into opening a tunnel for attackers](https://daily.dev/posts/fake-cloudflare-captcha-tricks-victims-into-opening-a-tunnel-for-attackers-gtqaorplr) · CSO Online · 0 upvotes · 0 comments --- Tags: [#golang](https://daily.dev/tags/golang), [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware), [#mac](https://daily.dev/tags/mac) [View this post on daily.dev](https://daily.dev/posts/mac-malware-drains-crypto-wallets-via-fake-captcha-scam-uljusbfph) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam","url":"https://daily.dev/posts/mac-malware-drains-crypto-wallets-via-fake-captcha-scam-uljusbfph","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/mac-malware-drains-crypto-wallets-via-fake-captcha-scam-uljusbfph"},"datePublished":"2026-08-18T16:16:33.441Z","dateModified":"2026-08-18T16:49:17.592Z","description":"Huntress analyzed a macOS infection stemming from a ClickFix social engineering attack, where a victim was tricked into pasting a Terminal command from a fake...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5bfb4f5ee8434a82e2f47dd27d6a7200?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5bfb4f5ee8434a82e2f47dd27d6a7200?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Huntress Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Huntress Blog","logo":"https://media.daily.dev/image/upload/s--kDC1MDsj--/f_auto,q_auto/v1780213277/logos/huntress-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/huntress-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/mac-malware-drains-crypto-wallets-via-fake-captcha-scam-uljusbfph","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"golang,crypto,malware,mac","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Huntress Blog","item":"https://daily.dev/sources/huntress-blog"},{"@type":"ListItem","position":3,"name":"Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/mac-malware-drains-crypto-wallets-via-fake-captcha-scam-uljusbfph#faq","mainEntity":[{"@type":"Question","name":"What is a ClickFix attack and how does it infect a Mac through the Terminal?","acceptedAnswer":{"@type":"Answer","text":"A ClickFix attack presents a fake CAPTCHA popup instructing the user to copy a command and paste it into Terminal. On one observed macOS infection, the pasted command downloaded a Bash profiler/loader from an attacker-controlled IP, which fetched a Mach-O payload matched to the CPU architecture, cleared Terminal history, and installed a Go-based stealer targeting Keychain and browser credentials. Security teams tracking social engineering tactics like ClickFix can follow emerging threat writeups on daily.dev."}},{"@type":"Question","name":"How does the DRAIN function in Mac crypto-stealing malware decide how much of a wallet to steal?","acceptedAnswer":{"@type":"Answer","text":"A DRAIN_PCT variable controls what percentage of a cryptocurrency wallet's balance gets siphoned rather than emptying it entirely. The malware calculates the value of 1% of the wallet's holdings per cryptocurrency, then has separate subroutines for Bitcoin, Litecoin, Dogecoin, Ethereum, and XRP to transfer the calculated portion to attacker-controlled wallets, leaving the victim the remainder. Developers building wallet security tooling can track emerging crypto-drainer techniques on daily.dev."}},{"@type":"Question","name":"How did the Mac stealer malware achieve persistence and avoid macOS Gatekeeper warnings?","acceptedAnswer":{"@type":"Answer","text":"The malware disguised itself using filenames mimicking legitimate Apple processes, such as com.apple.trustd and com.apple.softwareupdate, and registered itself via launchctl bootstrap into the Background Task Management subsystem. It stripped the quarantine extended attribute with xattr to bypass Gatekeeper warnings, and used an osascript dialog to phish the victim's password for elevated privileges. Mac admins hardening endpoint defenses can keep up with these persistence tricks via daily.dev."}}]} ```