Security researchers at **Huntress** have uncovered a new Go-based malware strain targeting **macOS** users. This infostealer is being delivered through 'ClickFix' attacks and is designed to pilfer a wide range of sensitive data, including cryptocurrency assets, browser-stored passwords, **Apple Keychain** data, and cached credentials. ### Sophisticated Cryptocurrency Theft The malware's most notable feature is its ability to intercept and redirect cryptocurrency transactions. Unlike typical crypto drainers that empty wallets entirely, this sophisticated variant can calculate the total value of a transaction and divert only a percentage to the attacker, potentially making the theft harder to detect immediately. ### The Attack Chain **Huntress** analysts observed the malware's delivery after responding to a ClickFix incident. The attack begins with a user receiving an email containing a link. This link directs them to a page instructing them to execute a command in **Terminal**. This command downloads a Bash script that acts as a profiler and malware loader. The script gathers system information, such as CPU and RAM details, and then retrieves a **Mach-O** payload tailored to the victim system’s processor architecture. ### Evasion and Persistence The profiler also identifies the current user's account name and creates a directory named after `trustd`, a legitimate **macOS** process responsible for validating cryptographic certificates and code signatures. The infostealing payload is then copied to this directory as `com.apple.verified`. Crucially, the malware removes the `com.apple.quarantine` extended attribute. This action prevents **Gatekeeper**, **macOS**'s built-in security feature, from flagging the file as quarantined and displaying a security alert upon execution. For persistence and privilege escalation, the malware employs a clever trick: it uses the `osascript` utility to create a fake error dialog box, prompting the user for system credentials.  *Source: Huntress* ### Data Exfiltration Targets Once established, the stealer payload scans the system for files containing credentials, identifying them by both name and extension. **Huntress** highlights that "Browser password databases, the **Apple Keychain**, and cached credentials in browser cookies are all targeted." ### Advanced Crypto Draining Capabilities The Go-based malware includes code specifically designed to modify cryptocurrency transactions *before* they are signed. This allows the attackers to redirect a configurable percentage of funds. **Huntress** notes this is the first time they have analyzed a crypto drainer that could remove less than the total amount from a victim's wallet.  *Source: Huntress* The researchers also observed functions that determine the value of 1% of a wallet’s content, adapting to different cryptocurrency types. Targeted cryptocurrencies include **Bitcoin**, **Litecoin**, **Dogecoin**, **Monero**, **Ethereum**, and **Ripple's XRP**. ### Attribution and Sanctions **Huntress** reports that the malware communicates with shared IP addresses within **Autonomous System (AS) 210644**, operated by a Russian corporation known as the **Aeza Group**. The **Aeza Group** and its affiliates have been sanctioned by the US and the UK for providing bulletproof hosting services to ransomware groups, linking this new threat to a known malicious infrastructure provider.