Researchers at Huntress have documented a campaign in which ClickFix-style attacks are used to deliver Go-based malware to macOS. The stealer can exfiltrate browser passwords, Apple Keychain data, cached credentials, and—most notably—gradually siphon funds from cryptocurrency wallets. The campaign targets macOS device owners who store crypto assets in local wallets and poses a direct financial threat: the malware can drain Bitcoin, Ethereum, Litecoin, Dogecoin, Monero and XRP wallets.
Infection chain: from clipboard to full control
The attack starts with a classic ClickFix scenario: the victim is tricked into pasting a malicious command into the macOS Terminal application. According to the researchers, this command launches a Bash script that performs system profiling—collecting detailed information about the hardware and host configuration. Based on the collected data, the script downloads a Mach-O payload compatible with the specific processor architecture of the victim’s machine.
The downloaded stealer, written in Go, implements several data theft vectors:
- Extraction of passwords saved in browsers
- Access to Apple Keychain and iCloud Keychain data
- Collection of cached credentials
- Exfiltration of all collected information to a remote attacker-controlled server
To escalate privileges, the malware uses a social engineering trick: the victim is shown a fake system notification about an “unexpected system error” and the need to repair corrupted files. Under this pretext, it requests the user’s system credentials.
Crypto wallet draining mechanism
The stealer’s most significant capability is its built-in DRAIN procedure. According to Huntress, the malware checks whether cryptocurrency wallets hold any funds and, upon detecting a balance, redirects part or all of the funds to a wallet controlled by the attacker. A separate draining function is implemented for each supported cryptocurrency—Bitcoin, Litecoin, Dogecoin, Monero, Ethereum and XRP.
Huntress researchers note that the malware includes dedicated functions to calculate the value of 1% of a wallet’s contents, depending on the target cryptocurrency. By their assessment, this is the first time malware has been observed that can withdraw an arbitrary fraction of a balance, rather than only the wallet’s full contents. It should be noted that this is the assessment of a single research team and has not been confirmed by independent sources.
Evolution of ClickFix: parallel campaigns
The discovered campaign is part of a broader wave of ClickFix attacks recorded by several research groups in recent weeks:
Target filtering on macOS. Microsoft reports on a campaign distributing MacSync and Atomic Stealer through a cluster of similar domains. The attackers use server-side browser fingerprinting and hardware validation to display malicious lures only to visitors with real macOS browsers, filtering out crawlers, sandboxes and automated analysis tools.
Abuse of Program Compatibility Assistant. Palo Alto Networks Unit 42 describes a variant that leverages the legitimate Windows binary pcalua.exe to evade parent-process heuristics. The victim is prompted to paste a command that launches PowerShell, which uses WMI to create cmd.exe, mounts a remote WebDAV resource, and downloads a malicious DLL via rundll32.exe. The WebDAV resource is exposed over HTTPS through CDN-fronted infrastructure, and each victim receives a unique tokenized URL with a UUIDv4-based path.
WebAssembly and steganography. Another campaign described by Unit 42 uses dynamic creation of WebAssembly modules and steganography via SVG images to evade network detection. Compromised legitimate sites execute injected JavaScript that builds a WASM module, which extracts URLs from SVG files to construct the final ClickFix lure URL with a fake verification page.
Related campaigns: pirated content as a vector
In parallel, campaigns distributing info-stealers via pirated content are being observed. According to Bitdefender, Lumma Stealer is being spread through files disguised as releases of the movie “Odyssey” in 1080p WEBRip and Blu-ray formats. In addition, Unit 42 reports the distribution of the Remus stealer—a 64-bit variant of Lumma Stealer—via fake sites offering cracked software and pirated games, promoted through search result poisoning.
Impact assessment
The highest risk is faced by macOS users who work with cryptocurrency wallets—especially those who keep significant amounts in local wallets supporting Bitcoin, Ethereum, Monero and the other listed cryptocurrencies. The partial draining mechanism makes theft less noticeable: losing 1% of a balance may go undetected for a long time, allowing the attacker to perform repeated withdrawals.
The theft of Apple Keychain and iCloud Keychain data creates additional risks of compromising the victim’s entire account ecosystem—from email services to banking applications.
Protection recommendations
- Never paste commands into Terminal or Run from untrusted sources. This is the primary vector for all ClickFix attacks. Any instruction that says “copy and paste into the terminal” from an unfamiliar source is a red flag.
- Configure monitoring of outgoing cryptocurrency wallet transactions with alerts for any transfers, including small amounts.
- Use hardware wallets to store significant crypto assets—they are not susceptible to software-based draining.
- Validate system dialogs: macOS does not request a password via non-standard pop-ups with messages about “corrupted system files.”
- For organizations: implement policies that restrict execution of arbitrary commands in Terminal, and control the launch of unsigned Mach-O binaries.
- On Windows systems: monitor for abnormal use of pcalua.exe, mounting of WebDAV resources, and process chains of PowerShell → WMI → cmd.exe → rundll32.exe.
The convergence of ClickFix techniques with crypto wallet draining functionality signals a shift by attackers from mass credential theft to targeted financial gain. A priority action for macOS crypto asset holders is to move funds to hardware wallets and review all recent transactions for unauthorized small transfers that may indicate an existing compromise.
