Huntress has discovered a Go-based macOS infostealer delivered through ClickFix attacks that steals cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. The malware also intercepts and redirects cryptocurrency transactions, and rather than always emptying a wallet, it can calculate a transaction’s total value and divert only a percentage to the attacker — the first crypto drainer Huntress has analyzed that removes less than the full amount.
How the ClickFix Delivery Lures the Victim Into Terminal
The victim receives an email with a link to a page that instructs them to run a command in Terminal. A Bash script acts as a profiler and loader, collecting system information such as CPU and RAM and fetching an architecture-matched Mach-O payload. The profiler identifies the logged-in account and creates a directory named after trustd, a macOS certificate and verification process, copying the payload there as com.apple.verified and removing com.apple.quarantine to bypass Gatekeeper alerts.
The Fake osascript Dialog That Captures the Admin Password
Persistence and privilege escalation are established through a fake osascript error dialog that collects the admin password. The dialog is the second social-engineering step in the chain, converting the initial ClickFix hook into elevated, persistent access without relying on a separate privilege-escalation exploit.
The Partial-Drain Capability That Reduces Detection
The drainer’s most unusual trait is that it does not always empty a wallet. It calculates the total value of a transaction and diverts only a percentage to the attacker, a design that reduces the chance the victim notices the theft immediately. Supported drain targets are Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple XRP, and the code includes functions computing 1 percent of wallet content value per coin type.
C2 Ties to Russian Bulletproof Hosting Infrastructure
Command-and-control communications point to IPs in AS 210644, operated by the Aeza Group, a Russian company sanctioned by the United States and the United Kingdom for providing bulletproof hosting to ransomware groups. The hosting tie connects a consumer-facing crypto-drainer campaign to infrastructure the sanctions regime has already designated as a sponsor of criminal operations.
What the macOS Drainer Means for Crypto Users and Defenders
For macOS users, the campaign shows that social engineering, not just vulnerable software, delivers working malware on the platform, and that pasting commands into Terminal from a web page is the critical error. Users should not paste commands from web pages into Terminal, and organizations should block or flag ClickFix patterns.
Endpoint Monitoring for the trustd-Named Directory
Organizations should keep macOS Gatekeeper and XProtect current and monitor for trustd-named directories and com.apple.verified payloads, which are the campaign’s persistence fingerprints. No patch applies because the attack relies on user interaction and standard macOS behavior being co-opted for persistence.
The campaign shows macOS-specific malware maturing into specialized financial crime, with the partial-drain feature an indication that operators now care about stealth over a one-shot empty. By taking only a fraction of a transaction, the drainer is designed to survive multiple transactions and a victim who never notices the leak, maximizing the extractable amount before detection. For a platform that has historically projected lower malware risk than Windows, the finding is a signal that the ClickFix social-engineering playbook, long associated with Windows-targeting campaigns, now commands full-weight macOS financial malware.
The analysis also pulls out a secondary risk that makes the drainer more than a wallet threat. Because the payload captures browser-stored passwords, Apple Keychain data, and cached credentials alongside cryptocurrency, a victim who avoids holding crypto still faces exposure of the account credentials stored on the device. The campaign’s use of trustd-named directories and com.apple.verified payloads gives incident responders a concrete artifact to hunt, but it also demonstrates how the malware layers its own fake process names onto legitimate macOS mechanisms to stay beneath casual inspection. As Huntress’s work makes clear, the practical defense remains the behavioral control: users who refuse to paste commands from a web page into Terminal never reach the loader, and that single decision is the effective boundary against the entire chain.
