Full Report
A ClickFix scam tricked a Mac user into running a Terminal command that installed Go-based malware able to steal Keychain passwords and drain crypto wallets.
Analysis Summary
# Tool/Technique: ClickFix to Go-Based macOS Stealer
## Overview
This attack involves a social engineering technique known as **ClickFix**, which tricks macOS users into manually executing a malicious command in the Terminal. The technique serves as a delivery mechanism for a multi-stage infection chain that ultimately deploys a Go-based Mach-O infostealer designed to exfiltrate sensitive credentials and drain cryptocurrency wallets.
## Technical Details
- **Type:** Malware family (Infostealer) / Social Engineering Technique (ClickFix)
- **Platform:** macOS (Intel x86_64 and Apple Silicon ARM64)
- **Capabilities:** Credential harvesting, keychain theft, cryptocurrency draining, system profiling.
- **First Seen:** Incident reported June 2026 (Refers to activity starting approximately March 2026).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- **[TA0005 - Defense Evasion]**
- [T1070.003 - Indicator Removal: Clear Command History]
- [T1140 - Deobfuscation/Decoding Files or Information]
- **[TA0006 - Credential Access]**
- [T1555.001 - Keychain]
- [T1555.003 - Credentials from Web Browsers]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **System Profiling:** The initial Bash loader collects detailed system information to ensure the environment is suitable for the payload.
- **Architecture Awareness:** The loader detects the CPU architecture (ARM64 vs. Intel) to download the specific native Mach-O binary optimized for the target Mac.
- **Credential Harvesting:** Specifically targets the macOS Keychain, browser password stores, and cached application credentials.
- **History Cleansing:** The initial command includes instructions to clear the Terminal window (`clear`) and delete the specific entry from the Bash/Zsh history to hinder forensic analysis.
### Advanced Features
- **Crypto Draining (DRAIN Function):** The Go-based malware contains a specific function to check for the presence of cryptocurrency wallet funds. It is capable of siphoning assets to attacker-controlled addresses.
- **Bulletproof Infrastructure:** The attack utilizes infrastructure hosted by Aeza Group, a sanctioned Russian provider known for high levels of resilience against takedowns.
## Indicators of Compromise
- **File Names:** `.UlaccK` (Temporary shell script)
- **Network Indicators:**
- `193.29.224[.]151` (Payload delivery)
- `profitnow[.]io` (Attacker domain)
- **Behavioral Indicators:**
- Execution of `curl` piped to `bash` via Terminal.
- Manipulation of Terminal history (`history -d`).
- Unexpected outbound connections to sanctioned IP ranges (Aeza Group).
## Associated Threat Actors
- While a specific group name is not provided, the activity is linked to users of the **Aeza Group** infrastructure, frequently utilized by Russian-speaking cybercriminal and ransomware collectives.
## Detection Methods
- **Behavioral Detection:** Monitor for Terminal processes spawning `curl` or `wget` to fetch files into `/tmp` followed by immediate execution.
- **Command Line Monitoring:** Alert on the use of `history -d` or `fc -p` in conjunction with network-related commands.
- **Network Monitoring:** Block or alert on traffic to known Aeza Group IP blocks (specifically those associated with AS210644).
## Mitigation Strategies
- **User Education:** Train users to never copy-paste commands into the Terminal from untrusted web popups or "CAPTCHA" prompts.
- **Hardening:** Implement Endpoint Detection and Response (EDR) tools that specifically monitor macOS synthetic execution and credential access.
- **Restricted Permissions:** Limit administrative rights to prevent unauthorized scripts from accessing sensitive system directories.
## Related Tools/Techniques
- **Amos Stealer (Atomic Stealer):** A similar macOS-focused infostealer.
- **MacSync Stealer:** Another recent macOS malware delivered via fake software download pages.
- **ClearFake:** A Windows-centric precursor/parallel technique that uses similar fake update/CAPTCHA overlays.