A Go-based malware delivered in ClickFix attacks is targeting macOS users, stealing cryptocurrency assets and sensitive information. The malicious payload can intercept and redirect transactions with various cryptocurrencies, allowing attackers to drain wallets while still calculating how much to divert to themselves.
The attack starts with a phishing email that tricks victims into running a command in Terminal, which downloads a Bash script acting as a profiler and malware loader. This script collects system information and retrieves the Mach-O payload tailored to the victim’s processor architecture. The profiler also identifies the logged-in user’s account name and creates a directory named after the trustd process, which is responsible for validating cryptographic certificates.
The infostealing and crypto-draining payload is then copied to the created directory as com.apple.verified, and its quarantined status is removed to prevent Gatekeeper from treating it as suspicious. The malware establishes persistence by collecting system credentials through a fake error created using the osascript utility. It also checks for files containing sensitive information such as browser password databases, Apple Keychain data, and cached credentials in browser cookies.
The Go-based malware’s ability to modify cryptocurrency transactions before they are signed is particularly concerning. Attackers can configure it to redirect only a percentage of the funds to themselves, making it difficult for victims to detect the theft. The researchers observed separate functions that determined the value of 1% of the wallet’s content, depending on the cryptocurrency type. Among the targeted assets are Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple’s XRP.
The malware communicates with shared IP addresses in Autonomous System (AS) 210644, which is operated by a Russian corporation known as the Aeza Group. The company has been sanctioned by the US and UK for providing bulletproof hosting services to ransomware groups.
This attack highlights the importance of robust cybersecurity measures for macOS users. With the rise of cryptocurrency thefts, it’s essential for individuals to be aware of potential threats and take proactive steps to protect their assets. This includes keeping software up-to-date, using strong passwords, and enabling two-factor authentication whenever possible.
As a practical takeaway, security teams should prioritize testing every layer of their defenses before attackers do. According to recent statistics, 54% of successful attacks are logged by security teams, but they often alert on only 14%. The remaining threats move through the environment undetected until it’s too late. Regular breach and attack simulation tests can help identify vulnerabilities in SIEM and EDR rules, ensuring that threats don’t slip by detection.
Source: Bleeping Computer — 2026-08-06