macOS Attacked

Overview

Security researchers at Huntress have uncovered a Go‑based macOS infostealer delivered through ClickFix phishing attacks. This malware is designed to steal cryptocurrency assets, browser‑stored passwords, Apple Keychain data, and cached credentials. More dangerously, it can intercept and redirect cryptocurrency transactions, siphoning off either the full amount or a calculated percentage of funds.

Attack Chain

• Phishing lure: Victims received emails with links instructing them to run a Terminal command.
• Profiler script: A Bash script collected system details (CPU, RAM, account name) and downloaded a Mach‑O payload tailored to the victim’s architecture.
• Persistence: Payload stored in a directory mimicking macOS’s trustd process, disguised as com.apple.verified. Gatekeeper alerts were bypassed by removing quarantine attributes.
• Privilege escalation: A fake error dialog created with osascript tricked users into entering admin credentials.

Capabilities of the Infostealer

• Credential theft: Targets browser password databases, Apple Keychain, and cached cookies.
• Crypto manipulation: Intercepts transactions before signing, redirecting funds to attacker wallets.
• Partial draining: Unique ability to divert only a percentage of funds (e.g., 1%), making theft less noticeable.
• Supported assets: Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple’s XRP.

Infrastructure and Attribution

• Malware communicates with IP addresses in AS210644, operated by the Aeza Group, a Russian corporation sanctioned by the US and UK for providing bulletproof hosting to ransomware groups.
• This infrastructure links the campaign to broader cybercrime ecosystems specializing in resilient hosting for malicious operations.

Defensive Guidance

• Avoid running unsolicited commands: Never execute instructions from untrusted emails or websites.
• Monitor Gatekeeper bypasses: Investigate files with removed quarantine attributes.
• Audit Keychain access: Detect unusual attempts to extract stored credentials.
• Use endpoint detection: Deploy MDR or EDR solutions capable of spotting persistence tricks and credential theft.
• Educate users: Train employees to recognize phishing lures and suspicious update prompts.

Expert in the Cloud Insight

The ClickFix campaign underscores how attackers are weaponizing trusted macOS processes and crypto‑draining innovations to evade detection. By diverting only fractions of transactions, they reduce suspicion while steadily siphoning funds. For defenders, the lesson is clear: macOS is not immune to advanced infostealers, and crypto theft tactics are evolving toward stealth and persistence.