High cybersecurity update: ClickFix attack pushes macOS infostealer for crypto theft attacks. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
A Go-based malware delivered in ClickFix attacks targeting macOS users is stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. […] ClickFix attack pushes macOS infostealer for crypto theft attacks A Go-based malware delivered in ClickFix attacks targeting macOS users is stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. The malware can intercept and redirect transactions with various cryptocurrencies. Although it can empty wallets entirely, it can also calculate the total value of a transaction to determine how much to divert to the attacker. Security researchers at Managed Detection and Response (MDR) services company Huntress discovered the payload after responding to a ClickFix incident. The targeted user received an email with a link to a page instructing them to run a command in Terminal. This downloaded a Bash script acting as a profiler and malware loader that collected system information (e.g., CPU, RAM) and retrieved a Mach-O payload that matched the victim system’s processor architecture. The profiler also identified the account name for the currently logged-in user and created a directory named after trustd, the macOS process responsible for validating cryptographic certificates and code signatures.
Technical Details
It copied the infostealing and crypto-draining payload to the directory as com.apple.verified and removed the com.apple.quarantine extended attribute to prevent Gatekeeper from treating the file as quarantined and showing a security alert when executed. According to Huntress’ analysis, the malware establishes persistence and increases privileges by collecting system credentials via a fake error created using the osascript utility. Fake dialog box prompting for admin password source: Huntress The stealer payload checks the storage for files containing credentials, identified both by name and their extension. However, the Go-based malware also includes code that modifies cryptocurrency transactions before they are signed, and can be configured to redirect to the attacker only a percentage of the funds. Malware can be configured to drain a certain crypto amount source: Huntress Huntress says that it is the first time they analyzed a crypto drainer that did not empty victims' wallets but could remove less than the total amount. Additionally, the researchers observed separate functions that determined the value of 1% of the wallet’s content, depending on the cryptocurrency type. Among the targeted cryptocurrency assets are Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP. According to Huntress, the malware communicates to shared IP addresses in Autonomous System (AS) 210644, which is “operated by a Russian corporation known as the Aeza Group.” The company and individuals affiliated with it have been sanctioned by the US and the UK for providing bulletproof hosting services to ransomware groups. Security teams log 54% of successful attacks and alert on just 14%.
Security Impact
Organizations using the affected technology should treat the report according to its high severity classification. The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. New ClickLock macOS malware traps users into revealing login password New CrashStealer malware poses as Apple crash reporting tool New XCSSET variant targets macOS devs via compromised Xcode projects Fake Roblox Xeno script launcher pushes infostealer, RAT malware Arch Linux disables AUR package adoption to stop malware flood Ionut Ilascu Ionut Ilascu is a technology writer with a focus on all things cybersecurity. The topics he writes about include malware, vulnerabilities, exploits and security defenses, as well as research and innovation in information security. His work has been published by Bitdefender, Netgear, The Security Ledger and Softpedia. Massive ChainDrop npm supply-chain attack infects hundreds of packages OpenAI, Anthropic AI agents targeted real people and systems in cyber tests Phishing service spoofs RingCentral to steal Microsoft 365 accounts AI is a data-breach time bomb: Read the new report Spend four hours inside a fully-simulated underground with DARKROOM. See how Skyhigh Security's patent-pending approach secures every browser session without costly and clunky enterprise browser replacements. Explore ESET’s H1 2026 Threat Report to uncover the latest AI, phishing, and ransomware trends.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: High
- Original source: BleepingComputer
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from BleepingComputer for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
