Summary
A ClickFix lure is being used to trick macOS users into pasting a command into Terminal that quietly installs a Go-based stealer. Once running, the malware harvests browser passwords, Apple Keychain data, and cached credentials, then goes after cryptocurrency wallets, redirecting balances to attacker-controlled addresses. What sets this ClickFix campaign apart is that it does not always empty a wallet outright; it can siphon off only a set percentage at a time to avoid drawing attention. All of the supporting infrastructure traces back to a sanctioned Russian bulletproof hosting provider.
Attack Details
A fake CAPTCHA lure leads to a pasted Terminal command
A Go-based stealer is being actively pushed through ClickFix attacks against macOS users, quietly siphoning cryptocurrency funds, browser-saved passwords, Apple Keychain entries, and cached credentials. The intrusion begins when the victim receives an email carrying a link, and once the page loads, a popup dressed up as a routine CAPTCHA check instructs them to copy a block of text and paste it into the Terminal. That single pasted line quietly reaches out to an attacker-controlled server, pulls down a first-stage shell script, runs it, and then wipes the Terminal window and clears the command history so the victim sees no trace of what just happened.
Fingerprinting, payload selection, and quarantine bypass
The downloaded script acts as a profiler and loader. It fingerprints the machine, gathering hardware identifiers, memory details, the processor architecture, and the name of the logged-in account, then uses that architecture check to fetch the matching build of the payload. Before running it, the script creates a folder whose name imitates a legitimate Apple certificate-validation process, drops the payload inside under a trustworthy-looking name, marks it executable, and strips the quarantine flag that macOS normally uses to warn users about files downloaded from the internet. The payload itself is a Go-based stealer, obfuscated to hide its inner workings, that ships in separate versions for Apple Silicon and Intel Macs. It settles in for the long term by registering itself as a background launch agent through the operating system’s own task-management framework, disguised as a software-update helper.
A fake password prompt unlocks browser and Keychain data
To gain the access it needs, the malware throws up a convincing fake password prompt built from a native scripting tool, tricking the victim into handing over their account credentials so it can make further changes without asking again. From there it sweeps the disk for anything valuable, matching files by name and extension to locate browser password databases, Apple Keychain contents, and cached credentials sitting in browser cookies.
A percentage-based wallet drain tied to sanctioned infrastructure
Harvested secrets are sent out to an attacker-run command-and-control server over plain HTTP on an unusual port. The most distinctive piece is a wallet-draining routine that checks whether a cryptocurrency address has a balance and, if it does, redirects the funds to wallets controlled by the attacker. Rather than emptying an account in one move, it can pull off only a set percentage at a time, calculating what each slice is worth to stay under the radar. It reaches across Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP, and every stage of the operation — loader hosting, payload delivery, and command-and-control — traces back to Aeza Group, a Russian bulletproof hosting provider sanctioned by the US, UK, and Australia.
A familiar ClickFix trick now aimed at macOS
ClickFix has fueled a steady stream of campaigns against Windows users, delivering a broad mix of malware from backdoors to loaders and infostealers. Its use here to plant a native macOS payload shows the same social-engineering trick being pointed at a wider set of targets.
Recommendations
Train users to spot ClickFix lures
Teach staff that no legitimate website or CAPTCHA ever asks them to copy a command and paste it into the Terminal. Any prompt that does is a ClickFix attack, and the safe response is to close it and report it.
Establish a rapid reporting and isolation path
Make sure users know to alert IT immediately if they run one of these commands, and have a process to pull the affected Mac into network isolation before the stealer can finish exfiltrating data or draining wallets.
Deploy script-blocking browser controls
Roll out script-mitigation add-ons such as NoScript to cut down on the fake CAPTCHA popups that kick off the ClickFix chain.
Filter malicious domains and hosting at the network edge
Block the ClickFix staging domain and sinkhole known-bad domains at the DNS layer, and block the attacker-controlled IP addresses tied to this activity outright.
Block sanctioned bulletproof hosting ranges
Deny inbound and outbound traffic to the Aeza Group address space used for loader delivery, payload hosting, and command-and-control, since legitimate business traffic to these ranges is unlikely.
Rotate exposed credentials and reset the Keychain
On any Mac suspected of infection, assume browser-stored passwords and Keychain contents are compromised, reset those credentials, and revoke active sessions.
Protect cryptocurrency holdings
Move funds from any potentially exposed hot wallet, favor hardware wallets for storage, and independently verify destination addresses before signing transactions, as this malware can quietly alter transactions before they are approved.
MITRE ATT&CK TTPs
Indicators of Compromise (IoCs)
| Type | Value |
|---|---|
| SHA256 | f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0619a99ba4ee9d7f33db8045c7e03c4265424977993fe8a53b0f45157c5abd3e55bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52b43a909a01e954d6549558f2f7e9bb58e34959a0ae229f340d61091ab726bbd3 |
| File Path | HOME/Library/Caches/com.apple.trustd/com.apple.verifiedHOME/Library/Caches/homeenergyd/com.apple.homeenergyd |
| IPv4 | 193[.]29[.]224[.]15177[.]221[.]152[.]34138[.]124[.]118[.]69 |
| IPv4:Port | 138[.]124[.]118[.]69[:]8133 |
| Domains | profitnow[.]io |
References & Patch Links
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
