ClickFix Attack Delivers macOS Infostealer That Can Redirect Cryptocurrency
Summary
Huntress analyzed a Go-based macOS infostealer delivered through ClickFix. It targets credentials and Apple Keychain data, and can alter cryptocurrency transactions to divert a configurable portion of funds.
Key points
- A victim was instructed by an email-linked page to run a Terminal command, which downloaded a Bash profiler and loader for a macOS payload.
- The payload was placed in a directory named trustd, given the name com.apple.verified, and had its quarantine attribute removed to avoid a Gatekeeper alert.
- Huntress says the malware uses a fake osascript error dialog to collect credentials and increase privileges.
- It targets browser password databases, Apple Keychain data, cached browser credentials, and other credential files.
- The malware can modify cryptocurrency transactions before signing and divert a configurable percentage rather than draining the full wallet.
- Huntress linked the malware’s communications to shared IP addresses in AS 210644, operated by Aeza Group.
Article Details
- Attack Vectors
- A targeted user received an email link to a page instructing them to run a command in Terminal.
- The command downloaded a Bash profiler and loader, which collected system information and retrieved a Mach-O payload matched to the victim system's processor architecture.
- The malware copied its payload to a directory named trustd as com.apple.verified and removed the com.apple.quarantine extended attribute to avoid a Gatekeeper security alert.
- A fake error dialog created with osascript prompted the user for an administrator password.
- The malware targeted browser password databases, Apple Keychain data, and cached credentials in browser cookies.
- The malware could intercept and alter cryptocurrency transactions before signing, redirecting either the full amount or a configured percentage.
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe payload was placed in a directory named trustd and named com.apple.verified.T1056.002 · GUI Input CaptureA fake error dialog created using osascript prompted the user to enter an administrator password.T1059.004 · Unix ShellA Bash script acted as the profiler and malware loader.T1105 · Ingress Tool TransferThe Bash loader downloaded and retrieved the Mach-O payload for the victim's processor architecture.T1204.001 · Malicious LinkThe ClickFix page linked from an email instructed the targeted user to run a command in Terminal.T1539 · Steal Web Session CookieThe malware targeted cached credentials in browser cookies.T1555.001 · KeychainThe malware targeted data stored in the Apple Keychain.T1555.003 · Credentials from Web BrowsersThe malware targeted browser password databases.T1562.001 · Disable or Modify ToolsThe malware removed the com.apple.quarantine extended attribute to prevent Gatekeeper from treating the payload as quarantined.T1565.002 · Transmitted Data ManipulationThe malware could modify cryptocurrency transactions before they were signed, redirecting some or all of the funds.T1657 · Financial TheftThe malware stole cryptocurrency by redirecting transaction funds, including a configurable percentage of a transaction.
Vendors
Products
Apple KeychainA Go-based malware delivered through ClickFix attacks is targeting macOS users to steal cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials.Gatekeeperthe directory as com.apple.verified and removed the com.apple.quarantine extended attribute to prevent Gatekeeper from treating the file as quarantined and showing a security alert when executed.macOSA Go-based malware delivered through ClickFix attacks is targeting macOS users to steal cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials.