Recent cyberattacks employing the ClickFix technique have been identified, delivering a Go-based malware designed to steal cryptocurrency assets and sensitive user data from macOS systems. This malware targets browser-stored passwords, Apple iCloud Keychain data, and cached credentials.
The infection process begins when a user is deceived into pasting a ClickFix command into the Terminal application. This action initiates a Bash script that profiles the system and downloads a Mach-O payload compatible with the computer’s CPU architecture. The payload is a Go-based stealer capable of capturing browser passwords, Apple Keychain data, and cached credentials, which are then transmitted to a remote server controlled by the attacker.
To escalate privileges, the malware presents a fake prompt requesting the user’s system credentials under the pretense of addressing an “unexpected system error” and restoring damaged system files. Notably, the malware includes a “DRAIN” function that checks for cryptocurrency wallets on the system. If funds are detected, it siphons a portion or the entirety of the assets to an attacker-controlled wallet. This function supports multiple cryptocurrencies, including Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple’s XRP.
Huntress security researcher Andrew Brandt highlighted the malware’s capability to deplete cryptocurrency accounts by transferring their contents into accounts under the threat actor’s control. This feature allows the malware to remove any amount from the wallet, not just its entire value.
The infrastructure hosting the malicious payloads and the command-and-control server are linked to Aeza Group, a Russian bulletproof hosting provider sanctioned by the U.S., the U.K., and Australia for facilitating malicious activities.
These developments underscore the evolving sophistication of ClickFix attacks, which have been increasingly used to target macOS users. Previous campaigns have distributed malware such as MacSync and Atomic Stealer, utilizing deceptive domains and server-side browser fingerprinting to selectively serve malicious content to genuine macOS browsers while evading detection by automated analysis tools.
Another variant of ClickFix exploits the Program Compatibility Assistant (pcalua.exe), a legitimate Windows binary, to bypass security heuristics. In this scenario, victims are tricked into executing a command that initiates a series of processes leading to the deployment of infostealer capabilities on the compromised host.
Additionally, some ClickFix campaigns employ advanced evasion techniques, such as on-the-fly WebAssembly module instantiation and steganography through SVG images, to avoid network-level detection. These methods involve using legitimate but compromised websites to execute malicious code, further complicating detection and mitigation efforts.
The increasing prevalence and sophistication of ClickFix attacks highlight the need for heightened vigilance among macOS users. It’s crucial to exercise caution when prompted to execute commands in the Terminal, especially those originating from unverified sources. Implementing robust security measures, such as keeping software up to date and using reputable security tools, can help mitigate the risk of such infections.
