Key Takeaways
- A new macOS infostealer is being spread through ClickFix social‑engineering tactics that trick users into pasting a malicious command into Terminal.
- Huntress first observed the malware in June 2026; it downloads a Bash loader that fetches a Mach‑O payload tailored to the victim’s CPU architecture.
- The Go‑based stealer harvests browser passwords, Apple Keychain entries, and cached credentials, and includes a “DRAIN” routine that can siphon funds from cryptocurrency wallets.
- All infrastructure—loader hosting, payload delivery, and command‑and‑control servers—ties back to the sanctioned Russian bullet‑proof hoster Aeza Group.
- Mitigation hinges on user education, script‑blocking browser extensions (e.g., NoScript), DNS‑level blocking (e.g., Pi‑Hole), and rapid isolation of compromised machines.
- If infection occurs, deleting the malicious binary and rebooting typically eradicates the threat, as the malware does not reconstitute itself after removal.
Overview of ClickFix Social‑Engineering Attacks
ClickFix is a deceptive technique that presents victims with a pop‑up window mimicking a CAPTCHA or verification form. The window instructs the user to copy a lengthy command string and paste it into the macOS Terminal application. Because the prompt appears legitimate, many users comply without realizing they are executing attacker‑controlled code. This method bypasses traditional email‑based phishing filters by relying on the user’s own action to launch the payload, making it especially effective against macOS users who may assume their system is inherently safer than Windows.
Discovery by Huntress in June 2026
Managed detection and response provider Huntress first encountered this particular ClickFix‑delivered infostealer in June 2026 during routine threat‑hunting activities. The company’s analysts noted a spike in anomalous Terminal commands originating from endpoint logs, which traced back to the characteristic ClickFix pop‑up pattern. Huntress subsequently published a detailed blog post outlining the infection chain, the malware’s capabilities, and recommended defensive measures, thereby alerting the broader security community to the emerging macOS threat.
Technical Breakdown of the Loader and Payload
The initial ClickFix command downloads a Bash profiler/loader script that gathers basic system information—such as OS version, hardware model, and installed applications—to fingerprint the victim. Based on the collected data, the loader then retrieves a second‑stage Mach‑O executable that matches the target’s processor architecture (Intel x86_64 or Apple Silicon arm64). By delivering a natively compiled binary, the malware avoids the overhead of interpretation layers and reduces the chance of detection by signature‑based scanners that might overlook architecture‑specific variants.
Data Exfiltration Capabilities of the Go‑Based Stealer
Once executed, the Mach‑O payload—written in the Go programming language—activates a suite of information‑gathering modules. It scans popular browsers (Safari, Chrome, Firefox) for stored credentials, extracts passwords from the Apple Keychain, and harvests cached session tokens, cookies, and autofill data. The stealer compresses the harvested data into an encrypted archive and exfiltrates it to a command‑and‑control (C2) server via HTTPS, often using legitimate‑looking user‑agent strings to blend in with normal web traffic. This comprehensive credential theft enables attackers to compromise accounts, conduct further lateral movement, or sell the data on underground markets.
Cryptocurrency Wallet Drain Function (“DRAIN”)
Beyond credential harvesting, the malware incorporates a specialized routine dubbed “DRAIN.” This function queries known cryptocurrency wallet applications (e.g., Exodus, Electrum, MetaMask) for wallet addresses and checks their balances via blockchain APIs or local wallet files. If funds are detected, the DRAIN module initiates a transaction that transfers either the entire balance or a configurable portion to attacker‑controlled wallets. The stealthy nature of this routine—operating after the user has already granted the malware elevated privileges via the Terminal command—makes it particularly dangerous for individuals and organizations holding digital assets.
Infrastructure Attribution to the Aeza Group
Investigations by Huntress and independent threat intelligence firms revealed that the domains hosting the Bash loader, the Mach‑O payload, and the C2 servers all resolve to IP addresses linked to the Aeza Group. Aeza is a sanctioned Russian bullet‑proof hosting provider known for offering resilient infrastructure to cybercriminal enterprises, including ransomware gangs and data‑theft operations. The use of Aeza’s services suggests a high level of operational sophistication and indicates that the attackers are likely part of a broader, financially motivated cybercrime syndicate rather than an isolated actor.
Mitigation Strategies for Organizations and Individuals
To defend against ClickFix‑style attacks, Huntress recommends a layered approach. First, user education is paramount: employees should be trained to verify unexpected pop‑ups, especially those requesting Terminal commands, and to report suspicious activity immediately. Second, deploying browser extensions that block unsafe scripts—such as NoScript, uBlock Origin, or ScriptSafe—can prevent the malicious pop‑up from loading in the first place. Third, network‑level defenses like Pi‑Hole or similar DNS sinkholing solutions can block known‑bad domains associated with the ClickFix infrastructure, reducing the likelihood that the initial command‑downloading step succeeds. Finally, enforcing least‑privilege principles on macOS endpoints (e.g., restricting Terminal access for standard users) can limit the damage even if a user inadvertently runs the command.
Response and Remediation Guidance
If a user suspects they have executed a ClickFix command, the immediate step is to disconnect the affected machine from the network and inform the IT or security team. The system should be placed into an isolation mode (e.g., quarantine VLAN or endpoint detection and response containment) to prevent further communication with C2 servers. Huntress notes that the malware may or may not achieve persistence; however, because it does not employ sophisticated mechanisms to regenerate itself after removal, deleting the malicious binary from the file system and clearing any associated launch agents or login items is typically sufficient to eradicate the threat. A subsequent scan with reputable anti‑malware tools can confirm that no remnants remain, after which the machine can be safely returned to service.
Conclusion and Outlook
The emergence of this ClickFix‑delivered macOS infostealer underscores a shifting threat landscape where attackers increasingly exploit social engineering to bypass platform‑specific defenses. By leveraging a seemingly innocuous CAPTCHA‑like prompt, they coax users into handing over execution rights, after which a capable Go‑based stealer harvests credentials and can directly pilfer cryptocurrency funds. The tethering of the operation to the sanctioned Aeza Group highlights the continued role of bullet‑proof hosting in enabling large‑scale cybercrime. Organizations must therefore combine technical controls—such as script‑blocking extensions and DNS filtering—with vigilant user training and rapid incident response to mitigate the risk posed by these evolving attacks. As macOS adoption grows in both consumer and enterprise environments, similar tactics are likely to proliferate, making proactive defense essential.