A newly analysed ClickFix campaign targeting macOS users demonstrates how attackers are combining social engineering, credential theft and cryptocurrency transaction manipulation into a single infection chain. The attack begins with an email containing a link to a webpage that instructs the victim to open Terminal and execute a command, effectively persuading the user to bypass the normal security barriers that would make an unsolicited application download appear suspicious. Once the command is executed, a Bash script profiles the system, identifies the processor architecture and retrieves a compatible Mach-O payload. The malware then establishes itself on the Mac, attempts to obtain administrative credentials and begins collecting passwords, browser information and cryptocurrency-related data. What makes the campaign particularly concerning is that the malware does not merely search for wallet files or credentials; it can interfere with cryptocurrency transactions themselves before the victim signs them. 

ClickFix has become attractive to attackers because it shifts the final stage of execution from an exploit to the user. Instead of attempting to bypass every browser and operating-system protection automatically, the malicious webpage provides instructions that convince the victim to run the attacker’s command voluntarily. macOS users may normally receive warnings when an unsigned or newly downloaded application attempts to execute, but a Terminal command can initiate a much more flexible infection chain. Once the user has copied and executed the command, the attacker can download additional scripts, select the appropriate payload for the system and perform actions that appear to originate from an interactive user session rather than from an obviously malicious installer.

The initial Bash loader performs reconnaissance before delivering the primary malware. It collects system information such as processor and memory details and determines which architecture the Mac is using so that the correct Mach-O binary can be downloaded. Architecture-aware delivery is important because Apple’s transition from Intel processors to Apple Silicon means malware operators frequently need separate payloads or binaries capable of running across both environments. By profiling the target first, the attacker avoids sending an incompatible executable that would fail and potentially alert the victim that something unusual has occurred.

The loader also identifies the name of the currently logged-in user and creates a directory that imitates `trustd`, the legitimate macOS process involved in evaluating certificates and code signatures. The malicious payload is copied into this directory under the name `com.apple.verified`, which is deliberately chosen to resemble an authentic Apple component. Naming malware after familiar operating-system services is a simple but effective technique because users and even administrators reviewing a process list may overlook something that appears to contain Apple-related terminology.

More importantly, the attack removes the `com.apple.quarantine` extended attribute from the downloaded payload. macOS normally attaches this attribute to files obtained from the internet, allowing Gatekeeper and related security mechanisms to recognize that the application originated from an external source and apply additional verification or warnings. Removing the quarantine attribute can prevent the normal warning workflow from being triggered when the file is subsequently executed. This demonstrates why security cannot depend solely on the initial download reputation of a file when an attacker has already persuaded the user to execute shell commands capable of modifying its metadata.

The campaign then attempts to obtain elevated privileges by displaying a fraudulent macOS error dialog using the legitimate `osascript` utility. The dialog requests the user’s password while presenting itself as part of an expected system or installation process. If the victim enters the password, the malware gains access to credentials that can be used to perform privileged actions on the device. This technique is particularly effective because macOS users are accustomed to legitimate applications occasionally requesting administrator credentials during installation or configuration. The attacker abuses that familiarity rather than attempting to defeat the operating system’s authentication mechanism directly.

Organizations should therefore treat unexpected authentication prompts as part of the attack surface. Users should understand that a password dialog appearing after executing a command copied from a webpage does not become trustworthy merely because it resembles a native macOS prompt. Administrators should also distinguish between genuine operating-system authorization workflows and applications using AppleScript or similar mechanisms to simulate credential requests. Endpoint monitoring can help identify unusual combinations such as Terminal launching `osascript` immediately after downloading and executing an unfamiliar binary.

Once installed, the Go-based infostealer searches the Mac for sensitive files based on both filenames and extensions. Huntress found that browser password databases, Apple Keychain information and cached browser credentials were among the targeted data. These sources can provide attackers with access to email, cloud applications, financial services and cryptocurrency exchanges. Browser cookies are particularly valuable because an attacker who steals an authenticated session may be able to access an account without knowing the victim’s password or completing the original multi-factor authentication process again.

Apple Keychain theft can have broader consequences because users often rely on Keychain to store credentials for websites, applications, wireless networks and other services. If malware is able to recover accessible Keychain information or credentials already available within the user’s session, the compromise may extend well beyond cryptocurrency assets. A victim initially targeted because of interest in digital currencies could subsequently lose access to email, cloud services or corporate accounts stored on the same Mac.

The malware’s cryptocurrency functionality makes the campaign considerably more dangerous than a conventional information stealer. Rather than waiting for stolen credentials to be monetized later, the malware can modify transaction details before the user signs them. This gives the attacker an opportunity to redirect cryptocurrency directly during an otherwise legitimate payment. The victim may believe they are sending funds to a known address while the malware substitutes an attacker-controlled destination somewhere between transaction preparation and final authorization.

Huntress reports that the malware targets several major cryptocurrencies, including Bitcoin, Litecoin, Dogecoin, Monero, Ethereum and XRP. Supporting multiple cryptocurrency networks suggests that the operators are attempting to maximize the number of potentially valuable victims rather than focusing on one ecosystem. Cryptocurrency users frequently manage several assets from the same computer, and one successful endpoint compromise may therefore expose multiple wallets and exchange accounts simultaneously.

A particularly interesting capability is the malware’s ability to calculate how much cryptocurrency to steal rather than automatically draining the entire wallet. Huntress observed functions that could determine the value of a percentage of the wallet’s holdings, including calculations associated with one percent of the available value. The malware can be configured to redirect only a portion of a transaction or wallet balance to the attacker.

This behaviour may represent an attempt to make theft less immediately obvious. Completely emptying a wallet creates an unmistakable incident and prompts the victim to investigate immediately. Stealing a smaller amount may be mistaken for a transaction error, fee discrepancy or user mistake, potentially allowing the malware to remain installed for longer. Repeated partial theft could ultimately generate substantial returns while reducing the probability that every victim identifies the endpoint as compromised after the first transaction.

The ability to modify transactions before signing also reinforces one of the fundamental principles of hardware-wallet security: transaction details must be verified on the trusted hardware device itself rather than only on the computer screen. If the Mac is compromised, anything displayed by wallet software running on the computer should be considered potentially manipulated. Users should compare the destination address and amount shown on the hardware wallet’s independent screen before approving the transaction.

For software wallets that rely entirely on the host computer, the consequences are more severe because the operating system may be the only trusted interface available to the user. Once an infostealer with transaction-manipulation capability controls the endpoint, the attacker may influence both what the user sees and what the wallet prepares for signing. High-value cryptocurrency holdings should therefore use hardware-backed signing where the private key and final transaction confirmation remain isolated from the ordinary desktop environment.

The malware communicates with infrastructure located in Autonomous System 210644, which Huntress identified as being operated by the Aeza Group. The company and affiliated individuals have previously been sanctioned by the United States and United Kingdom over allegations that their infrastructure provided bulletproof hosting services used by ransomware and other cybercriminal operations. The presence of the campaign on infrastructure associated with abuse illustrates the value criminals obtain from hosting providers willing to tolerate malicious activity, rapidly replace servers and resist ordinary abuse complaints.

However, defenders should avoid relying solely on one hosting provider or IP address range for detection. Malware infrastructure is disposable, and attackers can migrate command-and-control services rapidly after addresses become public. Behavioural indicators such as the ClickFix command sequence, creation of suspicious Apple-like directories, quarantine-attribute removal, credential prompts and unusual cryptocurrency application manipulation are likely to remain useful longer than individual IP addresses.

The infection chain provides several opportunities for detection before the final payload begins stealing information. Security teams can monitor for shells launched immediately after users visit unfamiliar websites or open phishing links, particularly when the commands download scripts through `curl` and pipe them directly into Bash or another interpreter. Downloading a remote script and immediately executing it eliminates the opportunity for the user or many security products to inspect the content before execution.

Organizations managing Macs should consider using application-control and endpoint-management policies that restrict the execution of unsigned or unapproved software. Users whose job roles do not require scripting or development tools should not routinely execute arbitrary Terminal commands received through websites, emails or collaboration platforms. Completely disabling Terminal is often impractical, especially for technical users, but behavioural controls can identify unusual execution patterns without preventing legitimate administrative work.

Endpoint detection should also monitor modifications to the `com.apple.quarantine` attribute. Utilities such as `xattr` have legitimate uses, but removing quarantine metadata from a freshly downloaded executable immediately before running it is highly suspicious. The combination of a browser download, shell execution, quarantine removal and execution from a hidden or system-like directory provides a much stronger detection signal than any individual event.

The creation of directories and executables deliberately named to resemble Apple services should also receive attention. Attackers commonly choose names beginning with `com.apple` or imitate processes such as `trustd` because these names blend into normal macOS activity. Security tools should validate the actual location, signature and parent process of executables rather than assuming that a familiar filename indicates legitimacy. A genuine Apple binary normally resides in a predictable system location and carries an Apple-issued signature.

The fake password prompt demonstrates why credential protection on macOS must extend beyond phishing-resistant web authentication. Passkeys and multi-factor authentication can significantly improve security against stolen website passwords, but they cannot stop a user from entering their local administrator password into a fraudulent native-looking dialog. Endpoint privilege management can reduce this risk by limiting when and how administrative credentials are used, particularly on systems used for financial activity or cryptocurrency management.

Organizations should also minimise the number of employees who possess permanent local administrator rights. If software installation requires a controlled elevation mechanism or temporary privilege grant, an unexpected password prompt becomes more suspicious and less likely to succeed. Privilege-management systems can also record which process requested elevation, providing useful evidence during an investigation.

Browser security remains relevant because the initial attack depends on convincing the user to follow instructions from a malicious webpage. Web filtering and DNS security can block known ClickFix infrastructure, newly registered domains and phishing pages, but these controls should not be expected to identify every campaign. Attackers can rapidly rotate domains and host lures on otherwise legitimate platforms. Browser controls must therefore be combined with endpoint monitoring that detects what happens after the page persuades the user to act.

Security-awareness training should address ClickFix explicitly rather than relying on generic advice such as avoiding suspicious attachments. Users should understand that websites should not require them to open Terminal, PowerShell or the Windows Run dialog and paste commands to complete a CAPTCHA, install an update, repair a browser or verify an account. The instruction itself is the warning sign regardless of how professional the page appears.

For cryptocurrency users, training should also emphasize that wallets, exchanges and blockchain services should not require arbitrary Terminal commands for routine verification or troubleshooting. Attackers know that cryptocurrency users are often technically comfortable and may be more willing than average consumers to execute command-line instructions. Technical confidence can therefore become part of the social-engineering strategy rather than a defence against it.

If a user executed the ClickFix command, the Mac should be treated as potentially compromised even if no immediate cryptocurrency theft is observed. The endpoint should be isolated from the network and examined for the downloaded Bash loader, unfamiliar Mach-O binaries, suspicious `trustd`-like directories, modified quarantine attributes and persistence mechanisms. Shell history and unified macOS logs may help reconstruct the initial command and identify the remote infrastructure contacted.

Investigators should examine browser databases, Keychain access, cookies, wallet applications and cryptocurrency-related files. Any account whose credentials or active session could have been available to the malware should be reviewed for unauthorized access. Passwords and API keys should be changed from a separate trusted device after the compromised Mac has been contained.

Cloud and web sessions should be revoked in addition to changing passwords. Stolen session cookies may remain valid after the underlying password has been reset, allowing an attacker to continue accessing the account. Email accounts deserve particular attention because control of email can support password resets against many other services and allow the attacker to hide notifications about unauthorized transactions.

Cryptocurrency wallets require an especially cautious response. If private keys, recovery phrases or wallet backups may have been exposed, assets should be migrated to new wallets generated on a trusted device using completely new keys. Simply reinstalling the operating system while continuing to use the same potentially compromised seed does not eliminate the risk.

Users should also review recent blockchain transactions carefully for address substitutions or unexpected transfers. Because the malware may steal only a percentage of the intended amount, victims should not limit their review to completely emptied wallets. Small unexplained transfers may be evidence of deliberate partial theft rather than ordinary transaction fees.

Where endpoint integrity cannot be established confidently, rebuilding the Mac from a trusted image is safer than deleting individual files. Information stealers can modify persistence settings, install additional components or retrieve secondary payloads that are not described in the initial analysis. A clean rebuild followed by controlled restoration of documents provides stronger assurance than assuming that removal of the identified binary eliminates every attacker-controlled component.

The attack also highlights the continuing growth of macOS-targeted malware. The historical assumption that cryptocurrency users and businesses can treat Macs as inherently less attractive to criminals is increasingly outdated. Attackers follow valuable users and valuable credentials, and macOS has become common among developers, executives, cryptocurrency investors and technology professionals who represent attractive targets.

Go is particularly useful to malware developers because it simplifies development of self-contained binaries and supports multiple operating systems and processor architectures. Its presence does not inherently make the malware sophisticated, but it allows criminal developers to maintain code that can potentially be adapted across macOS, Linux and Windows. Security teams should therefore focus on behaviour rather than treating programming language or binary format as a meaningful indicator of trust.

The campaign demonstrates a broader transition in cryptocurrency malware from passive credential collection to active transaction interference. Traditional stealers copy passwords, wallet files and browser data and then depend on attackers to monetise that information later. A transaction-aware implant can intervene at the moment value is moving and redirect funds immediately. This shortens the gap between compromise and financial loss and leaves defenders less time to detect the infection.

The possibility of percentage-based theft is especially important because it suggests attackers are considering victim psychology and detection thresholds rather than simply maximizing the value of one transaction. Malware that quietly diverts a portion of funds may persist longer, potentially stealing repeatedly from the same victim. Financial-security monitoring should therefore flag unexplained cryptocurrency address changes and transaction discrepancies even when the amounts are relatively small.

For enterprises, the incident is not relevant only to employees who hold cryptocurrency. The same malware steals credentials and browser sessions that may provide access to corporate resources. A Mac compromised through a personal cryptocurrency-related lure can become an entry point into Microsoft 365, Google Workspace, GitHub, cloud consoles or internal applications if the employee uses the same device for work.

Organizations permitting personally owned Macs or mixed personal and business use should therefore consider the risk of consumer-targeted malware entering the corporate identity environment. Device compliance, endpoint detection and conditional-access policies can limit what an infected unmanaged endpoint can reach. Sensitive applications should require managed devices rather than trusting a valid password or browser session alone.

The broader cybersecurity lesson is that modern malware increasingly succeeds by convincing users to perform actions that security systems were specifically designed to prevent attackers from performing automatically. macOS Gatekeeper can restrict suspicious downloads, but the user is persuaded to execute a Terminal command that removes the quarantine marker. Password protections exist, but the user is shown a convincing prompt and asked to supply the credential voluntarily. Wallet software verifies transactions, but malware attempts to alter the details before that verification occurs.

Defenders therefore need controls that examine the complete sequence of behaviour rather than trusting individual legitimate actions. Terminal, Bash, `curl`, `osascript` and `xattr` are normal macOS tools. None of them is malicious by itself. A browser lure followed by a remote script download, quarantine removal, fake authentication prompt and execution of an unsigned binary presents a very different risk profile when the events are correlated.

The ClickFix technique succeeds because it transforms the victim into part of the execution chain. The user is effectively asked to perform the actions that an exploit would otherwise have to achieve: launch the shell, download the payload and approve access. Preventing this class of attack therefore requires both technical restrictions and a simple behavioural rule that users can understand.

A webpage that unexpectedly asks someone to paste a command into Terminal should be treated as hostile until independently verified. Legitimate software vendors have safer installation mechanisms, and security checks should not require users to execute opaque shell commands copied from a browser. Once a webpage controls what is pasted into a shell, it is no longer merely displaying information. It is attempting to control the computer.

This campaign shows that the consequences can extend directly from that one action to password theft, Apple Keychain access, stolen browser sessions and manipulated cryptocurrency transactions. The strongest defence is therefore to interrupt the attack before the first command is executed, then reinforce that protection with endpoint controls capable of detecting the chain if social engineering succeeds.

A Go-based malware delivered in ClickFix attacks targeting macOS users is stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. [...]

Source: ClickFix attack pushes macOS infostealer for crypto theft attacks via Bleeping Computer — published 06 Aug 2026.