ClickFix Campaign Uses macOS Stealer That Can Drain Crypto Wallets
Summary
A ClickFix lure prompts macOS users to run a Terminal command that downloads a Go-based stealer. Huntress says it can collect credentials and redirect some or all funds from supported cryptocurrency wallets to attacker-controlled accounts.
Key points
- A ClickFix lure tricks victims into pasting a command into macOS Terminal, launching a Bash profiler and loader.
- The loader profiles the host and downloads a Mach-O payload matched to the computer’s processor architecture.
- The Go-based stealer can collect browser passwords, Apple Keychain data and cached credentials, then send them to a remote server.
- A fake system-error prompt attempts to obtain the victim’s system credentials.
- The DRAIN routine checks cryptocurrency wallet balances and can redirect part or all of the funds to attacker-controlled wallets; separate functions target Bitcoin, Litecoin, Dogecoin, Monero, Ethereum and XRP.
- The article links the payload-staging and command-and-control infrastructure to Aeza Group, a sanctioned Russian hosting provider.
Article Details
- Attack Vectors
- A ClickFix lure tricks victims into pasting a command into macOS Terminal, which runs a Bash profiler/loader that collects system details and downloads a CPU-matched Mach-O stealer.
- The macOS stealer uses a fake system-error prompt to solicit system credentials, steals browser passwords, Keychain data, and cached credentials, and sends stolen data to a remote server.
- The stealer's DRAIN routine checks cryptocurrency wallet balances and redirects some or all funds to attacker-controlled wallets.
- A separate Windows ClickFix variant tricks victims into pasting a command that launches PowerShell, uses WMI to create cmd.exe, mounts a remote WebDAV share, and loads a malicious DLL through rundll32.exe.
- Another ClickFix campaign uses injected JavaScript on compromised websites to instantiate WebAssembly and use steganographic SVG images to construct a fake-verification URL.
- Related campaigns reportedly use look-alike domains and browser or hardware checks to selectively serve macOS lures, deliver Lumma Stealer through files disguised as movie releases, and distribute Remus through cracked-software and pirated-game lures promoted with SEO poisoning.
MITRE ATT&CK
T1027.003 · SteganographyA separate ClickFix campaign uses steganography in SVG images while constructing the fake-verification URL.T1041 · Exfiltration Over C2 ChannelThe stealer transmits captured browser passwords, Keychain data, and cached credentials to a remote server operated by the threat actor.T1047 · Windows Management InstrumentationThe Windows variant uses WMI to create cmd.exe.T1056.002 · GUI Input CaptureThe malware presents a fake system-error prompt that asks victims to enter their system credentials.T1059.001 · PowerShellA separate Windows ClickFix variant launches PowerShell after the victim pastes a crafted command.T1059.003 · Windows Command ShellThe Windows variant uses WMI to create cmd.exe as part of mounting a remote WebDAV share and loading a malicious DLL.T1059.004 · Unix ShellThe macOS infection chain runs a Bash profiler/loader that gathers host details and retrieves the matching Mach-O payload.T1059.007 · JavaScriptA separate campaign uses injected JavaScript on compromised websites to instantiate WebAssembly and construct a ClickFix URL.T1082 · System Information DiscoveryThe Bash profiler/loader collects extensive system details before selecting and downloading a payload matching the victim's processor architecture.T1105 · Ingress Tool TransferThe Bash loader downloads a CPU-matched macOS payload; a separate Windows variant retrieves a malicious DLL from a remote WebDAV share.T1204.004 · Malicious Copy and PasteVictims are tricked by a ClickFix lure into pasting a command into Terminal or, in a separate Windows variant, into a Run window.T1218.011 · Rundll32The Windows variant loads a malicious DLL through rundll32.exe.T1497.001 · System ChecksA related macOS ClickFix campaign uses browser fingerprinting and hardware validation to block crawlers, sandboxes, and some automated analysis tools.T1555.001 · KeychainThe macOS stealer can capture Apple Keychain data.T1555.003 · Credentials from Web BrowsersThe macOS stealer can capture passwords stored in browsers.
Malware
Atomic StealerThe campaign also uses Aeza Group infrastructure and joins a broader wave of ClickFix attacks tied to MacSync, Atomic Stealer, Lumma Stealer, and Remus.Lumma StealerThe campaign also uses Aeza Group infrastructure and joins a broader wave of ClickFix attacks tied to MacSync, Atomic Stealer, Lumma Stealer, and Remus.MacSyncThe campaign also uses Aeza Group infrastructure and joins a broader wave of ClickFix attacks tied to MacSync, Atomic Stealer, Lumma Stealer, and Remus.RemusThe campaign also uses Aeza Group infrastructure and joins a broader wave of ClickFix attacks tied to MacSync, Atomic Stealer, Lumma Stealer, and Remus.
Vendors
Products
Apple iCloud KeychainClickFix-style lures are being used to deliver a Go-based macOS stealer that can harvest browser passwords, Apple iCloud Keychain data, cached credentials, and cryptocurrency holdings.macOSClickFix-style lures are being used to deliver a Go-based macOS stealer that can harvest browser passwords, Apple iCloud Keychain data, cached credentials, and cryptocurrency holdings.