Overview of ClickFix macOS Stealer Campaigns
Recent threat intelligence findings highlight a novel campaign utilizing social engineering techniques known as ClickFix to target macOS environments. According to The Hacker News, these attacks deliver a Go-based infostealer engineered to harvest sensitive user information, including browser-stored passwords, Apple iCloud Keychain data, and cached credentials. Most notably, the malware includes specialized routines designed to systematically drain cryptocurrency assets from compromised endpoints.
Technical Analysis of the Infection Chain
The attack vector relies heavily on social engineering, tricking victims into manually copying and pasting a malicious command into the native macOS Terminal application. Once executed, this initial trigger launches a Bash profiler and loader script.
Host Profiling and Architecture Matching
- System Profiling: The script collects extensive details regarding the host operating system and hardware configuration.
- Payload Retrieval: Based on the gathered architecture data, the loader fetches a compatible Mach-O payload. This ensures the Go-based malware operates effectively regardless of whether the target runs Apple Silicon or Intel hardware.
Privilege Escalation and Data Exfiltration
To bypass security boundaries, the stealer presents a fraudulent graphical prompt mimicking an unexpected system error, requesting the user’s system credentials under the guise of restoring damaged files. Once elevated privileges are secured, the malware extracts browser credentials, Keychain data, and session tokens, exfiltrating the data to command-and-control infrastructure hosted by the Aeza Group, a bulletproof hosting provider.
Cryptocurrency Draining Routines
A distinct capability of this macOS stealer is its multi-coin draining mechanism. Unlike traditional malware that simply sweeps an entire balance instantly, this variant incorporates specific subroutines to evaluate the exact worth of a wallet. It features logic tailored to calculate specific percentages—such as 1% valuations—across multiple digital currencies, including:
- Bitcoin
- Ethereum
- Litecoin
- Dogecoin
- Monero
- Ripple (XRP)
Defending Against ClickFix Social Engineering
Organizations operating mixed fleets containing macOS endpoints must account for human-centric vectors like ClickFix, which bypass conventional endpoint detection by weaponizing administrative tools against the user.
Recommended Mitigations
- Terminal Restrictions: Restrict or monitor interactive shell usage where feasible, and educate developers and standard users on the risks of executing unverified scripts found online.
- Behavioral Monitoring: Implement endpoint detection and response (EDR) solutions configured to alert on anomalous Terminal activity, such as scripts fetching external payloads immediately following user paste events.
- Credential Monitoring: Ensure continuous monitoring for credential stuffing and unauthorized access attempts targeting enterprise cloud services and local keychain stores.
Related: ClickFix Campaign Uses Server-Side Fingerprinting to Hide macOS Malware, Hotel Wi-Fi Campaigns Use CornFlake and ChocoShell Malware