ClickFix Targets macOS with an Infostealer Capable of Draining Crypto Wallets

An Email Leads the User to Terminal

On August 6, 2026, Huntress reported a Go-based malware targeting macOS users through ClickFix campaigns.

The infection chain begins with an email containing a link. The linked page tricks the victim into manually copying and executing a command in Terminal, relying on social engineering rather than an operating system vulnerability.

The command downloads a Bash script that gathers information about the machine, including its CPU, RAM, processor architecture, and active account name. It then retrieves a Mach-O payload compatible with the Mac’s architecture.

The exact macOS versions affected have not been disclosed.

Fake Apple Names and Gatekeeper Bypass

The script creates a directory named trustd, mimicking the name of the macOS component responsible for validating cryptographic certificates and code signatures. The payload is copied into it under the name com.apple.verified.

The malware also removes the com.apple.quarantine extended attribute. As a result, Gatekeeper no longer treats the file as downloaded and does not display the usual security warning when it is executed.

The code can also establish persistence and attempt to escalate privileges. To do so, it uses osascript to generate a fake error message requesting the user’s administrator password. A password entered into the fraudulent prompt could therefore give the attacker additional capabilities.

Credentials, Keychain, and Wallets Under Attack

The infostealer searches for passwords stored in browsers, credentials contained in cookies, Apple Keychain data, and information held in caches. Files are identified based on both their names and extensions.

The most serious capability, however, involves crypto-draining. The malware can modify a transaction before it is signed, replacing or altering the destination of the funds.

Two modes are possible:

• draining the entire wallet;
• stealing only a portion, calculated based on the amount and cryptocurrency involved.

Huntress identified functions dedicated to calculating 1% of a wallet’s balance, with variations depending on the asset being used. The malware can also calculate the total transaction value and determine how much to transfer to the attacker.

Targeted assets include Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP. According to Huntress, this is the company’s first analysis of a crypto-drainer designed not to necessarily steal an entire balance.

What to Check on a Mac

No specific patches, detection rules, or remediation procedures have been provided. Administrators should nevertheless focus EDR monitoring and logs on the stages observed in the chain:

• manual execution of commands in Terminal after opening a link received by email;
• Bash scripts downloaded during the session;
• trustd directories created in unusual locations;
• files named com.apple.verified;
• removal of the com.apple.quarantine attribute;
• administrator password prompts generated by osascript;
• communications with addresses in Autonomous System 210644.

AS 210644 is operated by Aeza Group, a Russian company sanctioned by the United States and the United Kingdom, along with affiliated entities, for providing bulletproof hosting to ransomware groups.

macOS users should never paste commands into Terminal at the request of a webpage or email message. Anyone who followed a ClickFix procedure should assume that any credentials entered may be compromised and immediately review their accounts, Keychain, and wallet transactions.