Blab Crypto
New macOS ClickFix Campaign Deploys Go-Based Infostealer and Crypto-Wallet Drain
Security researchers identified a new macOS infostealer that is being delivered through the ClickFix social‑engineering technique. Huntress, a managed detection and response firm, first detected the malware in June 2026. The attack begins with a pop‑up window that looks like a CAPTCHA prompt. The window instructs the user to copy a long command string and paste it into the Terminal application. The command downloads and runs a Bash profiler that gathers system details and then pulls a Mach‑O payload that matches the victim’s processor architecture.
The payload is a Go‑based stealer that scrapes browser password stores, Apple Keychain data, and cached credentials from the infected Mac. It also contains a DRAIN function that checks whether a cryptocurrency wallet on the machine holds funds and, if so, redirects all or part of the balance to attacker‑controlled wallets. The loader, payload hosting, and command‑and‑control infrastructure all point back to the Aeza Group, a Russian bulletproof hosting provider that was sanctioned by the U.S. Treasury in July 2025 for enabling ransomware and other cyber‑crime.
Huntress warned that the malware may or may not achieve persistence, but it can be removed by deleting any copies of the binary from the machine. The firm advised organizations to mitigate ClickFix threats through user education, the use of malicious‑script‑mitigation browser add‑ons such as NoScript, and DNS‑level blocking tools like Pi‑Hole. If a user inadvertently follows the exploit, Huntress recommends that the user notify the IT team immediately and isolate the machine.
ClickFix is a social‑engineering technique that first appeared in October 2023. It typically shows a pop‑up over a web page that instructs the viewer to run a system command that will install malware. Apple added a mitigation in March 2026 to prevent ClickFix‑style attacks by blocking the terminal‑based command execution flow. However, attackers have continued to evolve the technique, including a variant that uses the applescript:// URI scheme to bypass the Terminal requirement.
The new campaign is part of a broader trend of macOS infostealers that bypass Apple’s built‑in protections. Other recent examples include JaskaGO, a Go‑based stealer that targets both Windows and macOS, and CrashStealer, a native C++ infostealer that masquerades as Apple’s crash‑reporting utility. These attacks exploit legitimate macOS utilities and the operating system’s Gatekeeper and XProtect mechanisms to deliver credential‑stealing payloads.
The use of a Go‑based stealer is notable because Go binaries can be compiled into a single executable that is difficult to analyze and can be obfuscated with tools such as Go Garbler. The Mach‑O format used by macOS allows the payload to be tailored to the victim’s CPU architecture, ensuring that the binary runs on both Intel and Apple Silicon machines.
The Aeza Group’s involvement is significant because the group has been a key infrastructure provider for ransomware and malware operators. The U.S. Treasury’s sanctions list includes the group’s parent company and several front companies. By hosting the loader and payload, Aeza provides a resilient command‑and‑control channel that is difficult for law enforcement to shut down.
For macOS users, the primary defense is to avoid copying and pasting commands from untrusted sources. Browser extensions that block malicious scripts and DNS filters that block known bad domains can reduce the likelihood of a ClickFix pop‑up appearing. System administrators should keep macOS up to date, monitor for unusual Terminal activity, and enforce least‑privilege policies for user accounts.
In summary, the new macOS ClickFix campaign demonstrates that social‑engineering attacks remain a viable vector for credential and cryptocurrency theft. The malware’s reliance on a sanctioned hosting provider and a Go‑based stealer that targets multiple credential stores underscores the need for layered defenses and user awareness.
The payload is a Go‑based stealer that scrapes browser password stores, Apple Keychain data, and cached credentials from the infected Mac. It also contains a DRAIN function that checks whether a cryptocurrency wallet on the machine holds funds and, if so, redirects all or part of the balance to attacker‑controlled wallets. The loader, payload hosting, and command‑and‑control infrastructure all point back to the Aeza Group, a Russian bulletproof hosting provider that was sanctioned by the U.S. Treasury in July 2025 for enabling ransomware and other cyber‑crime.
Huntress warned that the malware may or may not achieve persistence, but it can be removed by deleting any copies of the binary from the machine. The firm advised organizations to mitigate ClickFix threats through user education, the use of malicious‑script‑mitigation browser add‑ons such as NoScript, and DNS‑level blocking tools like Pi‑Hole. If a user inadvertently follows the exploit, Huntress recommends that the user notify the IT team immediately and isolate the machine.
ClickFix is a social‑engineering technique that first appeared in October 2023. It typically shows a pop‑up over a web page that instructs the viewer to run a system command that will install malware. Apple added a mitigation in March 2026 to prevent ClickFix‑style attacks by blocking the terminal‑based command execution flow. However, attackers have continued to evolve the technique, including a variant that uses the applescript:// URI scheme to bypass the Terminal requirement.
The new campaign is part of a broader trend of macOS infostealers that bypass Apple’s built‑in protections. Other recent examples include JaskaGO, a Go‑based stealer that targets both Windows and macOS, and CrashStealer, a native C++ infostealer that masquerades as Apple’s crash‑reporting utility. These attacks exploit legitimate macOS utilities and the operating system’s Gatekeeper and XProtect mechanisms to deliver credential‑stealing payloads.
The use of a Go‑based stealer is notable because Go binaries can be compiled into a single executable that is difficult to analyze and can be obfuscated with tools such as Go Garbler. The Mach‑O format used by macOS allows the payload to be tailored to the victim’s CPU architecture, ensuring that the binary runs on both Intel and Apple Silicon machines.
The Aeza Group’s involvement is significant because the group has been a key infrastructure provider for ransomware and malware operators. The U.S. Treasury’s sanctions list includes the group’s parent company and several front companies. By hosting the loader and payload, Aeza provides a resilient command‑and‑control channel that is difficult for law enforcement to shut down.
For macOS users, the primary defense is to avoid copying and pasting commands from untrusted sources. Browser extensions that block malicious scripts and DNS filters that block known bad domains can reduce the likelihood of a ClickFix pop‑up appearing. System administrators should keep macOS up to date, monitor for unusual Terminal activity, and enforce least‑privilege policies for user accounts.
In summary, the new macOS ClickFix campaign demonstrates that social‑engineering attacks remain a viable vector for credential and cryptocurrency theft. The malware’s reliance on a sanctioned hosting provider and a Go‑based stealer that targets multiple credential stores underscores the need for layered defenses and user awareness.
