ClickFix Attack Deploys macOS Infostealer for Crypto Theft

Overview of the ClickFix macOS Infostealer Campaign

TheA new Go-based malware campaign, dubbed “ClickFix” by security researchers, is actively targeting macOS users to steal cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. Discovered by Huntress, this sophisticated infostealer demonstrates unique capabilities in its approach to cryptocurrency theft, including the ability to divert only a percentage of transaction funds rather than emptying entire wallets. The campaign primarily relies on social engineering tactics, compelling users to execute malicious commands via their Terminal application.

According to BleepingComputer, the attack begins with a targeted email containing a link that directs victims to a page instructing them to run a specific command in Terminal. This initial command downloads a Bash script, which acts as both a system profiler and a sophisticated malware loader, tailoring the subsequent payload to the victim’s system architecture.

Technical Analysis of the ClickFix Malware

Initial Access and Payload Delivery

The ClickFix campaign employs a multi-stage infection process. Upon a user executing the provided Terminal command, a Bash script is downloaded. This script first profiles the victim’s macOS system, collecting details such as CPU and RAM specifications. This information is crucial for fetching the correct Mach-O payload, ensuring compatibility with the victim’s processor architecture. The profiler also identifies the currently logged-in user’s account name, which is later leveraged for stealth and persistence.

Evasion and Persistence Mechanisms

The Bash script establishes a directory named after trustd, a legitimate macOS process responsible for validating cryptographic certificates and code signatures. Within this deceptive directory, the infostealing payload is copied as com.apple.verified. A critical step in the evasion process involves removing the com.apple.quarantine extended attribute from the malicious file. This action prevents macOS Gatekeeper from treating the file as quarantined, thereby circumventing security alerts upon execution. For persistence and privilege escalation, the malware utilizes the osascript utility to create fake error messages, tricking users into revealing system credentials.

Infostealing and Cryptocurrency Draining Capabilities

Once established, the Go-based malware scans storage for files containing credentials, identifying them by name and extension. Its primary targets include browser password databases, the Apple Keychain, and cached credentials within browser cookies. The cryptocurrency draining functionality is particularly noteworthy. The malware is designed to modify cryptocurrency transactions before they are signed, enabling the redirection of funds to the attacker. Huntress researchers observed that this malware can be configured to divert only a percentage of funds, a feature distinct from typical drainers that empty wallets entirely. The malware can calculate 1% of the wallet’s content value, depending on the cryptocurrency type. Targeted cryptocurrencies include Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple’s XRP.

Command and Control Infrastructure

The malware communicates with shared IP addresses within Autonomous System (AS) 210644. This AS is reportedly operated by the Aeza Group, a Russian corporation known for providing bulletproof hosting services to ransomware groups. The company and individuals associated with it have faced sanctions from the US and UK for their involvement in supporting malicious cyber activities.

How to Detect and Mitigate ClickFix macOS Infostealer

Defending against this sophisticated macOS infostealer requires a multi-layered approach focusing on user education, endpoint security, and network monitoring. Security professionals seeking how to detect ClickFix malware macOS should prioritize the following:

• User Awareness Training: Emphasize the dangers of unsolicited emails and links. Users must be educated to never run commands from untrusted sources in their Terminal, regardless of any accompanying instructions or promises of system fixes.
• Endpoint Detection and Response (EDR) Solutions: Implement EDR solutions capable of monitoring macOS endpoints for suspicious process execution, file system modifications (especially changes to extended attributes like com.apple.quarantine), and unusual network connections. Look for processes running from the trustd directory or attempting to create fake osascript prompts.
• Network Traffic Analysis: Monitor outbound network connections for communications to known malicious IP addresses or C2 infrastructure, particularly those associated with AS 210644. Detecting unusual traffic patterns or connections to sanctioned entities can indicate compromise.
• Credential Hygiene: Promote the use of strong, unique passwords and multi-factor authentication (MFA) across all accounts, especially for cryptocurrency exchanges and critical services. Regular rotation of passwords and auditing of Keychain access can also help limit exposure.
• Browser Security: Advise users to keep web browsers updated to the latest versions and consider using security-focused browser extensions that block malicious scripts and phishing attempts. Regularly clearing browser cache and cookies can also reduce the persistence of stolen credentials.
• Regular Backups: Maintain regular, encrypted backups of critical data, including cryptocurrency wallets if stored locally. This can aid in recovery following a successful attack.

To mitigate Go-based macOS infostealer threats like ClickFix, organizations must integrate these practices into their cybersecurity framework to protect against both initial infection and subsequent data exfiltration.

Related: DPRK-Linked macOS Malvertising Uses Fake Updates for Crypto Theft, ClickLock macOS Stealer: How Attackers Coerce Victims via App Kill Loops