Full Report
A Go-based malware delivered in ClickFix attacks targeting macOS users is stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. [...]
Analysis Summary
# Tool/Technique: Go-based macOS Infostealer & Crypto Drainer
## Overview
This is a sophisticated Go-based malware designed to target macOS users through "ClickFix" social engineering tactics. Its primary purpose is the exfiltration of sensitive credentials and the redirection of cryptocurrency transactions. Unlike traditional drainers that empty wallets entirely, this malware can be configured to steal specific percentages of a victim's assets to remain under the radar.
## Technical Details
- **Type:** Malware (Infostealer / Crypto Drainer)
- **Platform:** macOS (Universal/Mach-O)
- **Capabilities:** Credential harvesting, Keychain theft, crypto transaction manipulation, Gatekeeper bypass, and privilege escalation.
- **First Seen:** Reported August 2026 (via Huntress)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link] (ClickFix social engineering)
- **[TA0002 - Execution]**
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- [T1059.002 - Command and Scripting Interpreter: AppleScript]
- **[TA0003 - Persistence]**
- [T1547.011 - Boot or Logon Autostart Execution: Plist Modification]
- **[TA0005 - Defense Evasion]**
- [T1553.001 - Subvert Trust Controls: Gatekeeper Bypass] (Removing `com.apple.quarantine` attribute)
- [T1036.005 - Masquerading: Match Legitimate Name or Location] (Use of `trustd` and `com.apple.verified` naming)
- **[TA0006 - Credential Access]**
- [T1555.001 - Credentials from Password Stores: Keychain]
- [T1555.003 - Credentials from Password Stores: Credentials from Web Browsers]
- [T1539 - Steal Web Session Cookie]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Information Gathering:** Executes a Bash script to profile the system (CPU, RAM, architecture) to ensure the correct payload is delivered.
- **Credential Theft:** Targets browser password databases, cookies, and the macOS Keychain.
- **Crypto Redirection:** Modifies cryptocurrency transactions before they are digitally signed.
### Advanced Features
- **Configurable Draining:** Includes logic to calculate 1% (or other specific percentages) of a wallet's value rather than emptying it, likely to avoid immediate detection by the user.
- **Sophisticated Masquerading:** Creates directories mimicking the legitimate `trustd` process and names the payload `com.apple.verified` to blend into system logs.
- **Dynamic Phishing:** Uses `osascript` to trigger a fake system error dialog to trick the user into providing their administrative password for privilege escalation.
## Indicators of Compromise
- **File Names:**
- `com.apple.verified` (The main payload)
- `trustd` (The directory created in the user profile)
- **Network Indicators:**
- Shared IPs in **AS 210644** (Aeza Group / Russian Federation) [Defanged: `AS210644`]
- **Behavioral Indicators:**
- Execution of `xattr -d com.apple.quarantine` on newly downloaded binaries.
- Unexpected `osascript` prompts for administrative credentials.
- Outbound connections to bulletproof hosting providers associated with ransomware.
## Associated Threat Actors
- **Aeza Group (Infrastructure):** Associated with providing bulletproof hosting for the C2 infrastructure.
- **ClickFix Campaigns:** Various unidentified actors utilizing this specific social engineering template.
## Detection Methods
- **Behavioral Detection:**
- Monitor for the removal of the `com.apple.quarantine` attribute via `xattr`.
- Alert on scripts executing `osascript` to request passwords (specifically identifying "Fake Dialog" patterns).
- Detect unauthorized access attempts to `~/Library/Keychains/`.
- **Network Monitoring:** Flag traffic to AS 210644 or known Aeza Group infrastructure.
- **YARA:** Target the Go-based Mach-O headers and specific strings related to crypto-value calculation (e.g., functions calculating 1% of wallet balances).
## Mitigation Strategies
- **User Education:** Train users to never copy-paste commands into the Terminal from a website or popup (the "ClickFix" vector).
- **System Hardening:**
- Restrict the use of `osascript` where not operationally required.
- Implement Endpoint Detection and Response (EDR) to monitor for the deletion of extended file attributes.
- **Identity Management:** Encourage the use of hardware security keys (e.g., Yubikey) which are more resistant to credential theft than stored browser passwords.
## Related Tools/Techniques
- **ClearFake:** Another social engineering framework using similar "Update" or "Fix" notifications.
- **Atomic Stealer (AMOS):** A prevalent macOS infostealer with similar Keychain and browser targeting capabilities.