ClickFix Delivers macOS Malware That Steals Credentials and Drains Crypto Wallets
Summary
Huntress analyzed a ClickFix infection that delivered a Go-based macOS stealer. It targets Keychain and browser credentials and can siphon cryptocurrency to attacker-controlled wallets; the campaign used infrastructure linked to sanctioned Aeza Group.
Key points
- A victim was tricked by a fake CAPTCHA into pasting a command into Terminal, launching a shell-script loader.
- The loader profiled the Mac and downloaded a Mach-O payload tailored to the CPU architecture.
- The malware scrapes browser password stores, Apple Keychain data, cookies, and other cached credentials.
- Its DRAIN function can redirect part or all of supported cryptocurrency wallet balances to attacker-controlled addresses.
- The malware establishes persistence through macOS background-task mechanisms and can prompt victims for their passwords.
- Delivery, hosting, and command-and-control infrastructure were linked to Aeza Group, which was sanctioned by the US, UK, and Australia.
- Huntress recommends user education against fake CAPTCHA commands; suspected infections should be reported to IT and the device isolated.
Article Details
- Attack Vectors
- A ClickFix social-engineering popup impersonated a CAPTCHA and instructed the target to paste and execute a command in macOS Terminal.
- The command downloaded and ran a Bash profiler/loader, which collected system information and fetched a CPU-architecture-matched macOS stealer.
- The malware stole credentials from browser password stores, Apple Keychain, and cached browser credentials, and could redirect cryptocurrency wallet funds to attacker-controlled wallets.
- The malware established persistence through the Background Task Management subsystem and prompted the victim for credentials using an osascript dialogue.
- Defensive Notes
- Use malicious-script mitigation browser add-ons, DNS blocking for known-bad domains, and user education about fake CAPTCHA prompts that request terminal commands.
- If a user runs a ClickFix command, notify the IT team immediately and isolate the affected machine.
- Remediation can include deleting any remaining malware binaries; the article states the malware does not spontaneously reconstitute after deletion.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | profitnow[.]io | Domain used during the ClickFix phase to deliver the malicious command. |
| IPV4 | 138[.]124[.]118[.]69 | Aeza Group address used by the stealer for exfiltration and C2. |
| IPV4 | 193[.]29[.]224[.]151 | Aeza Group address used to host and deliver the loader. |
| IPV4 | 77[.]221[.]152[.]34 | Aeza Group address used to host and deliver payloads. |
| SHA256 | 5bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52 | SHA-256 of the profiler/loader Bash script. |
| SHA256 | 619a99ba4ee9d7f33db8045c7e03c4265424977993fe8a53b0f45157c5abd3e5 | SHA-256 of the x86_64 stealer executable. |
| SHA256 | b43a909a01e954d6549558f2f7e9bb58e34959a0ae229f340d61091ab726bbd3 | SHA-256 of a payload the article says was deployed for persistence. |
| SHA256 | f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0 | SHA-256 of the ARM64 stealer executable. |
| URL | hxxp[:]//193[.]29[.]224[.]151/92392991a0cca55?force=1 | Loader-download URL embedded in the ClickFix command. |
MITRE ATT&CK
T1056.002 · GUI Input CaptureAn osascript dialogue prompted the victim for a password so the malware could capture it.T1059.002 · AppleScriptThe ClickFix command was pasted into macOS Terminal and executed as a shell command.T1059.004 · Unix ShellThe ClickFix command and downloaded profiler/loader used Bash to execute the attack chain.T1071.001 · Web ProtocolsThe stealer communicated with its C2 server using HTTP.T1547.015 · Login ItemsThe payload was incorporated into macOS Background Task Management using launchctl bootstrap.T1555.001 · KeychainThe malware collected Apple Keychain data.T1567 · Exfiltration Over Web ServiceThe article reports credentials being exfiltrated to an external address.
People
Andrew BrandtByline author of the article.Anna PhamAcknowledged for contributions to the investigation, detection signals, and write-up.Bryan MastersAcknowledged for contributions to the investigation, detection signals, and write-up.Jai MintonAcknowledged for contributions to the investigation, detection signals, and write-up.
Vendors
Products
Apple Keychainused by macOS, and in this case the Go-based stealer was built to scrape browser password stores, Apple Keychain data, and cached credentials from the infected system.macOSHomeBlogWallet-Depleting macOS Malware Wants Your CryptoNoScriptreceiving ClickFix attack popups by installing malicious script mitigation browser add-ons, such as the NoScript browser extension (available for Chrome and Firefox). Network devices such as a PiHole DNS blackhole canPiHolesuch as the NoScript browser extension (available for Chrome and Firefox). Network devices such as a PiHole DNS blackhole can also reduce the likelihood of popups by blocking known-bad domains from resolving