Security researchers at Huntress have identified a new ClickFix campaign delivering a Go-based infostealer to macOS users that steals passwords and drains cryptocurrency wallets. The attack starts with an email containing a link to a page that asks the recipient to paste and run a command in Terminal — the classic ClickFix social-engineering lure, now refined for macOS. That command downloads a Bash loader that profiles the target machine (CPU, RAM, logged-in username) and pulls down a Mach-O binary matched to the victim’s processor architecture — Intel or Apple Silicon.
The malware disguises itself cleverly: it creates a directory named after trustd, Apple’s legitimate certificate-validation process, and saves its payload there as com.apple.verified. It strips the com.apple.quarantine extended attribute so Gatekeeper never flags it. To escalate privileges, it uses macOS’s osascript utility to generate a fake system error dialog that prompts for an admin password. Once it has that, it targets browser password databases, Apple Keychain contents, and cached credentials and cookies. What sets this payload apart is a built-in crypto-draining module: it intercepts cryptocurrency transactions before they are signed and can redirect funds to the attacker — either a fixed percentage or the entire balance. Huntress notes this is the first time they have encountered a macOS infostealer with a configurable transaction-hijacking capability. The malware’s command-and-control infrastructure runs through Autonomous System 210644, operated by Aeza Group, a Russian bulletproof-hosting provider that the US and UK sanctioned for supporting ransomware operations.
How to check if you’re affected
Affected devices are any Mac — Intel or Apple Silicon — whose user recently ran a Terminal command from a web page or email prompt. Check for suspicious persistence entries by running launchctl list and looking for unfamiliar items under com.apple.* names, especially com.apple.verified. Inspect ~/Library/LaunchAgents/ for unknown .plist files. If you entered your admin password in an unexpected dialog shortly after running a Terminal command from the web, assume compromise and rotate all passwords stored in your browser and Keychain, revoke API keys, and move any cryptocurrency to a fresh wallet.