Full Report
ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host and then fetches a macOS malware payload that's compatible with the computer's CPU architecture. "
Analysis Summary
The following summary is based on the technical details provided in the article regarding recent macOS-focused ClickFix campaigns.
# Tool/Technique: ClickFix (macOS Stealer Variant)
## Overview
ClickFix is a social engineering technique where victims are tricked into executing malicious commands under the guise of fixing a system error or verifying their browser. In this specific macOS campaign, users are prompted to paste a command into the Terminal, which initiates an infection chain designed to steal sensitive data and drain cryptocurrency wallets.
## Technical Details
- **Type:** Malware (Go-based Infostealer) / Social Engineering (ClickFix)
- **Platform:** macOS (supporting both Intel and Apple Silicon architectures)
- **Capabilities:** Credential theft (browsers, iCloud Keychain), system profiling, and automated cryptocurrency draining.
- **First Seen:** Reported August 2026 (based on article date).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- [T1204.002 - User Execution: Malicious File]
- **[TA0004 - Privilege Escalation]**
- [T1548.003 - Abuse Elevation Control Mechanism: sudo/Credential Prompting]
- **[TA0006 - Credential Access]**
- [T1555.001 - Credentials from Password Stores: Keychain]
- [T1555.003 - Credentials from Password Stores: Web Browsers]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **System Profiling:** Uses a Bash script to collect hardware and OS details to ensure the correct architecture-specific payload (Mach-O) is delivered.
- **Information Theft:** Extracts passwords from major web browsers and accesses the Apple iCloud Keychain for stored credentials.
- **Privilege Escalation:** Deploys fake system error prompts to trick users into entering their administrative password.
### Advanced Features
- **Crypto "DRAIN" Routine:** Unlike traditional stealers that only take wallet files, this malware can programmatically calculate 1% of a wallet's value and siphon funds incrementally or in bulk.
- **Architecture Awareness:** Dynamically fetches payloads compatible with either x86_64 or ARM64 (M-series) CPUs.
- **Anti-Analysis:** Uses server-side fingerprinting and hardware validation to block sandboxes and automated crawlers from seeing the malicious payload.
## Indicators of Compromise
- **File Names:** `Bash profiler/loader` (often executed directly via Terminal command).
- **Network Indicators:**
- `aeza[.]net` (Associated infrastructure)
- Infrastructure linked to Aeza Group (Russian bulletproof hosting).
- **Behavioral Indicators:**
- Unexpected requests to paste commands into Terminal.
- Non-standard "System Error" dialog boxes asking for admin passwords.
- Outbound connections to known bulletproof hosting IP ranges.
## Associated Threat Actors
- **Aeza Group:** Infrastructure provider (Sanctioned entity).
- **Unknown Operators:** Often distributed by various affiliates using "Stealer-as-a-Service" models.
## Detection Methods
- **Behavioral Detection:** Monitoring for the execution of `curl` or `wget` commands piped directly into `bash` or `sh` via the Terminal.
- **Process Monitoring:** Detecting unauthorized attempts by third-party binaries to access `~/Library/Keychains/`.
- **Network Monitoring:** Alerting on traffic to known Aeza Group subnets and sanctioned hosting providers.
## Mitigation Strategies
- **User Education:** Train users never to paste commands from a website into their Terminal or PowerShell.
- **Endpoint Security:** Utilize Endpoint Detection and Response (EDR) tools that flag "curling to bash" behaviors.
- **System Hardening:** Ensure macOS Gatekeeper and XProtect are active and restrict the execution of unsigned binaries where possible.
## Related Tools/Techniques
- **Atomic Stealer (AMOS):** Another prominent Go-based macOS infostealer.
- **MacSync:** Often bundled in similar ClickFix campaigns.
- **WebAssembly (Wasm) Steganography:** Used in related variants to hide malicious URLs within SVG images.