# ClickFix Attack Deploys macOS Infostealer for Crypto Theft

> The ClickFix attack leverages a Go-based macOS infostealer to pilfer cryptocurrency, browser data, and Apple Keychain credentials via a Bash script loader.

- Published: 2026-08-07T02:08:44.000Z
- Severity: high
- Category: Malware
- Tags: ClickFix, macOS, Infostealer, Cryptocurrency, Golang
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/
- Canonical: https://runtimerebel.com/blog/clickfix-attack-deploys-macos-infostealer-for-crypto-theft

## Key points

- Immediate impact: macOS users are at risk of cryptocurrency theft and credential compromise from the ClickFix infostealer.
- Affected systems: macOS operating systems are targeted by a Go-based malware designed to exfiltrate sensitive data.
- Remediation: Users should exercise extreme caution with unsolicited emails and avoid running untrusted commands in Terminal.

## Overview of the ClickFix macOS [Infostealer](/glossary#infostealer) Campaign

TheA new Go-based [malware](/glossary#malware) campaign, dubbed "ClickFix" by security researchers, is actively targeting macOS users to steal cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. Discovered by Huntress, this sophisticated infostealer demonstrates unique capabilities in its approach to cryptocurrency theft, including the ability to divert only a percentage of transaction funds rather than emptying entire wallets. The campaign primarily relies on [social engineering](/glossary#social-engineering) tactics, compelling users to execute malicious commands via their Terminal application.

According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/), the attack begins with a targeted email containing a link that directs victims to a page instructing them to run a specific command in Terminal. This initial command downloads a Bash script, which acts as both a system profiler and a sophisticated malware loader, tailoring the subsequent [payload](/glossary#payload) to the victim's system architecture.

## Technical Analysis of the ClickFix Malware

### [Initial Access](/glossary#initial-access) and Payload Delivery
The ClickFix campaign employs a multi-stage infection process. Upon a user executing the provided Terminal command, a Bash script is downloaded. This script first profiles the victim's macOS system, collecting details such as CPU and RAM specifications. This information is crucial for fetching the correct Mach-O payload, ensuring compatibility with the victim's processor architecture. The profiler also identifies the currently logged-in user's account name, which is later leveraged for stealth and [persistence](/glossary#persistence).

### Evasion and Persistence Mechanisms
The Bash script establishes a directory named after `trustd`, a legitimate macOS process responsible for validating cryptographic certificates and code signatures. Within this deceptive directory, the infostealing payload is copied as `com.apple.verified`. A critical step in the evasion process involves removing the `com.apple.quarantine` extended attribute from the malicious file. This action prevents macOS Gatekeeper from treating the file as quarantined, thereby circumventing security alerts upon execution. For persistence and [privilege escalation](/glossary#privilege-escalation), the malware utilizes the `osascript` utility to create fake error messages, tricking users into revealing system credentials.

### Infostealing and Cryptocurrency Draining Capabilities
Once established, the Go-based malware scans storage for files containing credentials, identifying them by name and extension. Its primary targets include browser password databases, the Apple Keychain, and cached credentials within browser cookies. The cryptocurrency draining functionality is particularly noteworthy. The malware is designed to modify cryptocurrency transactions before they are signed, enabling the redirection of funds to the attacker. Huntress researchers observed that this malware can be configured to divert only a percentage of funds, a feature distinct from typical drainers that empty wallets entirely. The malware can calculate 1% of the wallet's content value, depending on the cryptocurrency type. Targeted cryptocurrencies include Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP.

### Command and Control Infrastructure
The malware communicates with shared IP addresses within Autonomous System (AS) 210644. This AS is reportedly operated by the Aeza Group, a Russian corporation known for providing bulletproof hosting services to [ransomware](/glossary#ransomware) groups. The company and individuals associated with it have faced sanctions from the US and UK for their involvement in supporting malicious cyber activities.

## How to Detect and Mitigate ClickFix macOS Infostealer

Defending against this sophisticated macOS infostealer requires a multi-layered approach focusing on user education, [endpoint](/glossary#endpoint) security, and network monitoring. Security professionals seeking **how to detect ClickFix malware macOS** should prioritize the following:

*   **User Awareness Training**: Emphasize the dangers of unsolicited emails and links. Users must be educated to never run commands from untrusted sources in their Terminal, regardless of any accompanying instructions or promises of system fixes.
*   **Endpoint Detection and Response ([EDR](/glossary#edr)) Solutions**: Implement EDR solutions capable of monitoring macOS endpoints for suspicious process execution, file system modifications (especially changes to extended attributes like `com.apple.quarantine`), and unusual network connections. Look for processes running from the `trustd` directory or attempting to create fake `osascript` prompts.
*   **Network Traffic Analysis**: Monitor outbound network connections for communications to known malicious IP addresses or [C2](/glossary#c2) infrastructure, particularly those associated with AS 210644. Detecting unusual traffic patterns or connections to sanctioned entities can indicate compromise.
*   **Credential Hygiene**: Promote the use of strong, unique passwords and multi-factor authentication ([MFA](/glossary#mfa)) across all accounts, especially for cryptocurrency exchanges and critical services. Regular rotation of passwords and auditing of Keychain access can also help limit exposure.
*   **Browser Security**: Advise users to keep web browsers updated to the latest versions and consider using security-focused browser extensions that block malicious scripts and [phishing](/glossary#phishing) attempts. Regularly clearing browser cache and cookies can also reduce the persistence of stolen credentials.
*   **Regular Backups**: Maintain regular, encrypted backups of critical data, including cryptocurrency wallets if stored locally. This can aid in recovery following a successful attack.

To **mitigate Go-based macOS infostealer** threats like ClickFix, organizations must integrate these practices into their cybersecurity framework to protect against both initial infection and subsequent [data exfiltration](/glossary#data-exfiltration).

**Related:** [DPRK-Linked macOS Malvertising Uses Fake Updates for Crypto Theft](/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-theft), [ClickLock macOS Stealer: How Attackers Coerce Victims via App Kill Loops](/blog/clicklock-macos-stealer-how-attackers-coerce-victims-via-app-kill-loops)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/clickfix-attack-deploys-macos-infostealer-for-crypto-theft