Key Takeaways
- A macOS‑focused ClickFix attack delivers a Go‑based stealer that can harvest browser passwords, Apple Keychain data, cached credentials, and siphon cryptocurrency funds.
- The malware’s “DRAIN” routine can partially empty wallets, calculating the value of as little as 1 % of holdings for Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP.
- Privilege escalation is achieved through a fake system‑error prompt that tricks users into entering their macOS credentials.
- All observed payloads and command‑and‑control (C2) infrastructure trace back to Aeza Group, a Russian bullet‑proof hosting provider sanctioned by the U.S., U.K., and Australia.
- Recent ClickFix campaigns employ diverse evasion tactics: look‑alike domains with browser‑fingerprinting gates, abuse of Windows pcalua.exe, and WebAssembly/SVG steganography to hide malicious URLs.
- Parallel stealer operations distribute Lumma Stealer via fake movie‑file lures and Remus (a Lumma variant) through cracked software and pirated game downloads, highlighting the breadth of ClickFix abuse across platforms and content types.
Introduction
ClickFix‑style social engineering attacks have resurfaced as a versatile delivery mechanism for information‑stealing malware. The technique lures victims into pasting a seemingly innocuous command into a terminal or run dialog, which then executes a loader that fetches a second‑stage payload tailored to the victim’s environment. Recent observations show that these attacks are no longer limited to Windows; macOS users are now being targeted with a Go‑based stealer capable of exfiltrating a wide range of sensitive data and, notably, draining cryptocurrency wallets in incremental amounts.
Infection Chain Overview
The infection chain begins when the user copies a ClickFix command into the macOS Terminal app. Executing the command launches a Bash profiler/loader that gathers extensive system details—including CPU architecture, installed software, and security controls—to determine the appropriate Mach‑O binary to download. The loader then retrieves a second‑stage payload that matches the host’s processor (e.g., x86_64 or arm64), ensuring the malware runs natively without triggering architecture‑based detections. This profiling step also helps the threat actor bypass automated sandboxes that lack the expected hardware fingerprint.
Go‑Based Stealer Capabilities
The delivered payload is a Go‑compiled Mach‑O binary that functions as a multi‑purpose information stealer. It harvests credentials stored in popular browsers (Chrome, Firefox, Safari), extracts data from Apple’s iCloud Keychain, and collects cached credentials from various applications. All harvested data is packaged and exfiltrated to a command‑and‑control server controlled by the attacker. In addition to credential theft, the malware includes a sophisticated routine designed specifically for cryptocurrency asset depletion, marking it as a notable evolution beyond typical credential‑stealing malware.
DRAIN Routine and Cryptocurrency Theft
Embedded within the stealer is a function dubbed “DRAIN” that continuously monitors cryptocurrency wallets installed on the victim’s machine. When a wallet containing funds is detected, the malware calculates the value of a configurable fraction—down to as little as 1 % of the wallet’s balance—based on the current market price of the targeted coin. It then initiates a transaction that transfers that amount to an attacker‑controlled address. Separate implementations of DRAIN exist for Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple’s XRP, allowing the threat actor to siphon funds across multiple blockchain ecosystems without emptying the entire wallet in a single, conspicuous transaction.
Privilege Escalation Tactics
To gain deeper access to the host, the malware presents a fabricated system‑error dialog that prompts the user to enter their macOS login credentials under the pretense of repairing “damaged system files.” This social‑engineering mimicry exploits the user’s trust in legitimate macOS prompts, enabling the stealer to obtain administrative rights. With elevated privileges, the malware can persist across reboots, access protected keychain items, and modify system settings to hinder removal or detection.
Infrastructure Attribution to Aeza Group
Investigations traced the domains hosting the malicious payloads and the C2 servers to infrastructure operated by Aeza Group, a Russian bullet‑proof hosting provider. Aeza has been sanctioned by the United States, the United Kingdom, and Australia for facilitating cybercriminal activities, including malware distribution and command‑and‑control operations. The association with a sanctioned host underscores the sophistication and resourcing behind the ClickFix campaign, indicating that the threat actors have access to reliable, abuse‑resistant hosting services.
macOS ClickFix Campaign: MacSync and Atomic Stealer
One of the recent ClickFix campaigns targeting macOS distributes two malware families—MacSync and Atomic Stealer—through a network of look‑alike domains that mimic legitimate software download sites. The campaign incorporates a server‑side browser‑fingerprinting and hardware validation gate, which serves the malicious lure only to visitors whose environment matches a genuine macOS browser. Automated crawlers, sandboxes, and certain analysis tools are blocked, reducing the likelihood of early detection by security researchers.
Windows Variant Abusing pcalua.exe
A parallel ClickFix variant focuses on Windows systems by abusing the legitimate Program Compatibility Assistant executable (pcalua.exe). Victims are tricked into pasting a crafted command that launches PowerShell, uses Windows Management Instrumentation (WMI) to spawn cmd.exe, mounts a remote WebDAV share hosted on a CDN‑fronted infrastructure, and loads a malicious DLL via rundll32.exe. The WebDAV share delivers a unique, tokenized URL (UUIDv4 path) for each victim, ensuring that the payload is dynamically generated and difficult to block with static URL filters. Once the DLL is executed, it deploys infostealer capabilities similar to those seen in the macOS variant.
WebAssembly and SVG Steganography Technique
Another ClickFix iteration leverages on‑the‑fly WebAssembly (wasm) module instantiation combined with steganography embedded in SVG images. The attack begins with compromised legitimate websites that inject malicious JavaScript. This script builds a wasm module that extracts URLs from which SVG files are downloaded; the SVGs contain hidden ClickFix URLs. When the final URL is dropped into the DOM via a script tag, a fake verification page appears, presenting a checkbox. Clicking the box reveals instructions to paste content into the Windows Run dialog, thereby triggering the malicious payload. This multi‑layered approach helps evade network‑level detection by blending malicious traffic with benign‑looking web assets.
Lumma Stealer Disguised as Movie Files
Separate from the ClickFix operations, researchers uncovered a campaign that distributes Lumma Stealer via files masquerading as 1080p WEBRip and Blu‑ray releases of the newly released film The Odyssey. Users seeking pirated copies download what appears to be a high‑quality video file, only to execute a malicious payload that installs Lumma Stealer. The lure exploits the popularity of recent movie releases and the willingness of users to bypass legitimate channels, highlighting how attackers continue to blend piracy lures with information‑stealing malware.
Remus Distribution via Cracked Software and Pirated Games
A second stealer campaign spreads Remus, a 64‑bit variant of Lumma Stealer, through cracked software and pirated game lures hosted on fraudulent websites. These sites employ SEO poisoning to rank highly in search results for popular game cracks or utility tools. When users download and execute the seemingly legitimate installer, Remus is silently deployed, harvesting credentials, browser data, and cryptocurrency wallets. The use of trusted‑looking installers lowers the user’s guard and increases the infection rate among audiences seeking free or unauthorized software.
Conclusion and Defensive Recommendations
The evolving ClickFix ecosystem demonstrates how attackers combine social engineering, platform‑specific abuse, and advanced evasion techniques to deploy versatile stealers capable of both credential theft and incremental cryptocurrency drainage. To mitigate these threats, organizations and individuals should: restrict terminal and run‑dialog execution privileges for non‑administrative users; employ application‑control solutions that block unauthorized scripting engines (e.g., PowerShell, WMI); maintain up‑to‑date endpoint detection and response (EDR) tools capable of detecting anomalous Bash or wasm behavior; educate users about the risks of pasting unsolicited commands into terminals or run dialogs; and monitor for connections to known Aeza Group infrastructure or other bullet‑proof hosting providers. Vigilance, layered defenses, and user awareness remain critical in countering the multifaceted nature of ClickFix‑driven malware campaigns.