{"id":2282,"date":"2026-08-07T21:20:04","date_gmt":"2026-08-07T21:20:04","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2282"},"modified":"2026-08-07T21:20:04","modified_gmt":"2026-08-07T21:20:04","slug":"clickfix-attacks-deliver-macos-stealer-that-can-drain-crypto-wallets","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2282","title":{"rendered":"ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 07, 2026<\/span><\/span>Malware \/ Social Engineering<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials.<\/p>\n

The macOS-focused infection chain is designed to deliver a shell script that profiles the host and then fetches a macOS malware payload that’s compatible with the computer’s CPU architecture.<\/p>\n

\u00abWhile the malware payload is capable of stealing passwords, its most interesting function is its capability to slowly deplete cryptocurrency accounts, siphoning their contents into accounts under the threat actor’s control,\u00bb Huntress security researcher Andrew Brandt said<\/a>.<\/p>\n

The attack chain begins with pasting a ClickFix command into the Terminal app, triggering the execution of a Bash profiler\/loader that collects extensive system details and then retrieves a Mach-O payload that matches the victim’s processor architecture. The payload is a Go-based stealer that can capture browser passwords, Apple Keychain data, and cached credentials and transmit them to a remote server operated by the threat actor.<\/p>\n

Like other macOS stealers, the malware attempts to escalate privileges by prompting the victim to enter their system credentials via a fake prompt under the guise of an \u00abunexpected system error\u00bb and restoring damaged system files.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

What’s notable about the malware is that it also packs in a \u00abDRAIN\u00bb routine that checks if a cryptocurrency wallet holds funds, and if so, redirects a chunk or all of it to an attacker-controlled wallet. There exist multiple versions of the same function based on the cryptocurrency being targeted. This includes Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple’s XRP.<\/p>\n

\u00abWhile this may not be a brand new feature, it’s the first time we have seen malware capable of emptying a cryptocurrency wallet that could be used to remove any less than the entire wallet’s value,\u00bb Huntress said. \u00abThe malware contained separate functions to determine just how much 1% of the wallet’s contents is worth, depending on which cryptocurrency the malware targets.\u00bb<\/p>\n

The server staging the malicious payloads and the command-and-control (C2) server all link back to infrastructure belonging to Aeza Group, a Russian bulletproof hosting provider that has been sanctioned by the U.S., the U.K., and Australia for facilitating bad actors.<\/p>\n

\"\"<\/a><\/div>\n

The disclosure comes as a number of ClickFix attacks have been reported in recent weeks –<\/p>\n