A sophisticated Go-based malware delivered via ClickFix attacks is targeting macOS users to steal cryptocurrency, browser passwords, and Apple Keychain data.

Key Takeaways

  • ClickFix attacks use deceptive Terminal commands to install macOS malware.
  • The malware can selectively divert percentages of cryptocurrency transactions to attackers.
  • Targets include Bitcoin, Ethereum, Monero, and Apple Keychain data.

Security researchers at Huntress have uncovered a highly sophisticated Go-based malware delivered through ClickFix attacks. This malicious payload specifically targets macOS users, aiming to exfiltrate cryptocurrency assets, browser-stored passwords, and sensitive Apple Keychain data.

The Anatomy of the Attack

The infection vector begins with a deceptive email containing a link to a malicious webpage. Users are instructed to execute a specific command in their Terminal. This action triggers a Bash script that acts as a profiler, gathering system specifications like CPU and RAM to download a tailor-made Mach-O payload. To evade detection, the malware disguises itself using the name trustd—a legitimate macOS process—and removes the 'com.apple.quarantine' attribute to bypass Gatekeeper security alerts.

Why This Matters

BozokMedia analysis shows that this is not a standard 'smash and grab' operation. Unlike traditional drainers that empty a wallet completely, this malware is uniquely programmed to calculate transaction values and divert only a specific percentage (e.g., 1%) to the attacker. This subtle approach allows the theft to remain undetected for longer periods.

This malware marks a significant evolution in crypto-theft, moving from total wallet drainage to stealthy, calculated transaction manipulation.

Targeted Assets and Infrastructure

The malware is designed to target a wide array of cryptocurrencies, including Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP. Furthermore, the command-and-control infrastructure has been linked to IP addresses operated by the Aeza Group, a Russian corporation sanctioned by the US and UK for providing hosting services to ransomware groups.

Did You Know?: The malware uses the 'osascript' utility to create fake system dialog boxes, tricking users into entering their admin passwords.

Frequently Asked Questions

1. How can I tell if my Mac is infected?
Look for unusual Terminal activity or unexpected requests for administrative privileges via pop-up dialogs.

2. Does this affect all Mac users?
While it targets macOS, users who follow instructions from untrusted web pages or emails are at the highest risk.