A sophisticated Go-based malware is actively targeting macOS users, employing a 'ClickFix-style' attack vector to facilitate the theft of cryptocurrency assets, browser-stored passwords, **Apple iCloud Keychain** data, and cached credentials. The infection chain is engineered to deliver a shell script that first profiles the victim's host system. Subsequently, it fetches a **macOS** malware payload specifically tailored to the computer's CPU architecture. "While the malware payload is capable of stealing passwords, its most interesting function is its capability to slowly deplete cryptocurrency accounts, siphoning their contents into accounts under the threat actor's control," stated **Huntress** security researcher **Andrew Brandt**.  ### The Attack Modus Operandi The attack typically commences with the victim pasting a **ClickFix** command into the **Terminal** application. This action triggers the execution of a Bash profiler/loader, which meticulously gathers extensive system details. Following this, it retrieves a **Mach-O** payload that precisely matches the victim's processor architecture. This payload, a Go-based stealer, is designed to capture sensitive information such as browser passwords, **Apple Keychain** data, and cached credentials, transmitting them to a remote server controlled by the threat actor. ### Privilege Escalation and Crypto Draining Similar to other **macOS** stealers, this malware attempts to escalate privileges. It achieves this by presenting the victim with a deceptive prompt, masquerading as an "unexpected system error" requiring system credentials to restore damaged system files. A particularly notable feature of this malware is its integrated "DRAIN" routine. This function actively checks for funds within cryptocurrency wallets and, if detected, redirects a portion or the entirety of the funds to an attacker-controlled wallet. The malware contains multiple variations of this function, each tailored to specific cryptocurrencies, including **Bitcoin**, **Litecoin**, **Dogecoin**, **Monero**, **Ethereum**, and **Ripple's XRP**. "While this may not be a brand new feature, it's the first time we have seen malware capable of emptying a cryptocurrency wallet that could be used to remove any less than the entire wallet's value," **Huntress** observed. "The malware contained separate functions to determine just how much 1% of the wallet's contents is worth, depending on which cryptocurrency the malware targets."  ### Infrastructure and Broader ClickFix Trends The infrastructure used to stage the malicious payloads and the command-and-control (C2) servers all trace back to **Aeza Group**, a Russian bulletproof hosting provider. **Aeza Group** has been sanctioned by the U.S., U.K., and Australia for its role in facilitating malicious activities by threat actors. This disclosure comes amidst a surge in reported **ClickFix** attacks across various platforms: * A **macOS ClickFix** campaign distributing **MacSync** and **Atomic Stealer** malware. This campaign utilizes a cluster of look-alike domains and implements server-side browser fingerprinting and hardware validation to selectively serve lures only to visitors whose environment appears consistent with a genuine **macOS** browser, effectively blocking crawlers, sandboxes, and automated analysis tools. * A **ClickFix** variant that abuses **Program Compatibility Assistant** ("pcalua.exe"), a legitimate **Windows** binary, as a launcher to bypass parent-process heuristics. **Palo Alto Networks Unit 42** explained that victims are tricked into pasting a crafted command that spawns **PowerShell**, uses **WMI** to create **cmd.exe**, mounts a remote **WebDAV** share, and loads a malicious DLL through **rundll32.exe**. This DLL then deploys infostealer capabilities. * Another **ClickFix** campaign leveraging on-the-fly **WebAssembly (wasm)** module instantiation and steganography via **SVG** images to evade network-level detection. This activity uses compromised websites with injected malicious **JavaScript** to build a **wasm** module that extracts URLs from which **SVG** files are downloaded to construct the **ClickFix** URL. This final URL is then embedded into the DOM to display a fake verification page, prompting users to paste content into a Run window. These findings also coincide with the discovery of two other distinct stealer campaigns. One delivers **Lumma Stealer** through files disguised as 1080p **WEBRip** and **Blu-ray** releases of *The Odyssey*. The other uses cracked software and pirated game lures hosted on fake websites via **SEO** poisoning to drop **Remus**, a 64-bit variant of **Lumma Stealer**.