Huntress identified a Go-based Mach-O infostealer delivered through a ClickFix attack on a macOS user.
The malware hides in a directory named after trustd and strips the quarantine attribute. BleepingComputer reports a fake osascript prompt that captures an admin password while harvesting browser passwords, Keychain data, and cached cookies.
Its DRAIN function targets Bitcoin, Litecoin, Dogecoin, Ethereum, and XRP. It can steal a configurable share of a wallet rather than draining it entirely.
The loader, hosting, and C2 trace to Aeza Group, a Russian hosting provider. The US Treasury sanctioned Aeza Group in July 2025, and the UK and Australia joined that November.
Huntress has documented a ClickFix macOS malware campaign that tricks users into pasting a Terminal command from a fake verification prompt. The Go-based stealer harvests browser passwords, Keychain data, and cached credentials, and can quietly redirect part or all of a cryptocurrency wallet’s balance to attacker-controlled addresses.
Huntress found the malware during a June 2026 retrospective threat hunt, on a system infected roughly three months earlier, and published its analysis on August 6. BleepingComputer reported the findings the same day.
For enterprise teams, the case shows macOS endpoints remain exposed to social engineering that never touches a malicious attachment. A single pasted command can expose Keychain data, drain crypto wallets, and hijack cached browser sessions.
The infection began when the target clicked an email link. The page showed a fake CAPTCHA popup instructing them to paste a command into Terminal, the core ClickFix mechanic: execution shifts from a downloaded file to something the victim types themselves.
The command pulled a file from an attacker IP, ran it, deleted itself, then cleared the Terminal window and history, leaving few visible traces.
That file was a Bash profiler and loader. It collected hardware identifiers, RAM, CPU details, and the username, checked whether the processor was ARM64 or x86_64, then fetched the matching Mach-O payload. Huntress notes ClickFix has surged in popularity and appears in many variants it tracks.
Top 10 Cybersecurity Challenges for Enterprises
Top 10 enterprise cybersecurity challenges, causes, and Hexnode's mitigation strategies.
Additional details from Huntress’s investigation:
The ClickFix page used the domain profitnow[.]io during the initial lure stage.
One IP address hosted the loader, while a separate IP address in the same hosting range served the final payloads, splitting delivery across two hosts.
Two distinct Mach-O binaries sat on that infrastructure at the same time, one built for ARM64 and the other for x86_64, so the operators had pre-staged payloads for both Apple Silicon and Intel Macs before profiling any victim.
Hiding behind Apple’s own naming conventions
With the ClickFix macOS malware in place, the loader script copied the payload into a cache directory named after trustd, Apple’s certificate-validation process, then renamed it com.apple.verified. The script also stripped the quarantine attribute to avoid a Gatekeeper flag.
A second payload, staged under a com.apple.softwareupdate path, had its attributes removed and was ad hoc signed. It was then registered as a launch agent through Background Task Management to persist after a restart. The malware also used osascript, a legitimate automation tool, to display a fake password prompt and capture the victim’s credentials.
Email link led to a fake CAPTCHA popup instructing a Terminal command
Bypasses attachment-based email defenses entirely
Profiling and delivery
Bash loader profiled the Mac and fetched an architecture-matched Mach-O payload
Confirms active, device-tailored payload delivery
Staging and evasion
Payload copied into a trustd-named directory, quarantine attribute stripped
Reduces the Gatekeeper warnings admins rely on
Privilege elevation
Fake osascript prompt captured the victim’s password
Extends attacker access beyond the initial session
Credential and wallet theft
Stealer harvested browser and Keychain data; DRAIN function intercepted crypto transactions
Exposes stored credentials and cryptocurrency holdings
Infrastructure
Loader, hosting, and C2 traced to Aeza Group, sanctioned by the US and UK in July 2025
Links the incident to established bulletproof hosting
What this ClickFix macOS malware actually takes
Browser password databases, identified by file name and extension across common browser install paths.
Apple Keychain data, giving attackers access to stored system and application credentials.
Cached browser cookies, which can enable session hijacking without needing a fresh login.
Cryptocurrency wallet balances, through a DRAIN function that checks wallet holdings before redirecting funds.
A configurable percentage of each transaction, rather than the full balance, which Huntress said is the first crypto drainer it has analyzed that’s capable of taking less than a wallet’s full value.
The stealer supports Bitcoin, Litecoin, Dogecoin, Ethereum, and XRP, using distinct code for the Bitcoin-based currencies, Ethereum, and XRP.
Securing the Mac fleet against ClickFix-style attacks
Hexnode UEM gives Mac fleets concrete controls here. Google Santa enforces application allowlisting, blocking unsigned Mach-O binaries in disguised cache folders. CrowdStrike Falcon and SentinelOne add behavioral detection for suspicious process activity. Privacy Preferences Policy Control lets admins manage app access to protected macOS services like Camera, Screen Recording, and Full Disk Access on behalf of users. Firewall, FileVault, and patch enforcement round out the baseline.
Hexnode XDR adds unified incident visibility, a dashboard view of MITRE ATT&CK events, and one-click response, process kill, file quarantine, endpoint isolation, alongside UEM. This is established on Windows today. Hexnode’s help documentation does not yet describe macOS support for XDR.
Google Santa allowlisting blocks unsigned binaries before execution
CrowdStrike Falcon or SentinelOne detect suspicious process activity
Privacy Preferences Policy Control restricts Apple Events, blunting osascript prompts
Hexnode XDR’s unified dashboard and one-click response, documented for Windows endpoints
Featured resource
The Cybersecurity Blueprint
Guide to choosing and implementing an effective cybersecurity strategy, covering statistics, frameworks, and organizational steps.
Did stripping the quarantine attribute help evade detection here?
Not meaningfully. Huntress notes curl doesn’t set the quarantine attribute in the first place, making this step largely redundant here, though it remains standard evasion in loaders that use tools which do apply the flag.
Is the crypto-draining function present in every version?
Yes. Huntress found DRAIN compiled into both the ARM64 and x86_64 builds, with a DRAIN_PCT setting controlling how much of a wallet gets redirected rather than always draining it fully.
Does this malware always establish persistence?
Not always, per Huntress. When it does, it registers a launch agent through Background Task Management to survive a restart.
Conclusion
The more distinctive lesson from this ClickFix macOS malware campaign isn’t a new exploit. It’s how convincingly the malware blends into Apple’s own process names and automation tools to avoid a second look. Any Mac can be talked into running a Terminal command, no vulnerability required.
Security teams should treat unsolicited Terminal instructions as a hard stop, no matter how legitimate the prompt looks. Pairing user education with macOS-specific hardening and third-party detection tooling remains the most practical way to catch what native defenses and email filters miss.
Stop ClickFix before it reaches Terminal.
Harden Mac fleets with Hexnode UEM and layered macOS endpoint security today.
A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions—without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable—politely.
