“In a ClickFix attack, the computer's user is presented with a popup window that appears to be a form of CAPTCHA prompt,” Huntress said.
How the ClickFix social engineering trick works
Security vendor Huntress encountered this macOS campaign in June 2026 and described it as a ClickFix social engineering attack. The victim sees a popup that mimics a CAPTCHA prompt and is instructed to copy a long command string and paste it into the Terminal application. That single user action — copying and pasting the command — is the initial vector: the string typically downloads and executes the first-stage component of the intrusion.
Bash loader, Mach-O payloads, and architecture matching
Once the pasted command runs, it executes a Bash profiler/loader that collects system details and then fetches a native Mach-O payload matched to the machine's processor architecture. Mach-O is the executable format used by macOS; in this campaign the loader chains to a Go-based final-stage stealer implemented as a Mach-O binary for the target CPU.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhat the Go-based stealer takes and the DRAIN function
Huntress reports the Go-based stealer was built to scrape browser password stores, Apple Keychain data, and cached credentials from infected systems. The malware also included a capability Huntress describes as a DRAIN function: it can check whether a cryptocurrency wallet held funds and then redirect all or part of that balance to attacker-controlled wallets.
Infrastructure ties: Aeza Group connection
The loader, payload hosting and command-and-control infrastructure used in this campaign all link back to the Aeza Group, which Huntress identifies as “a sanctioned Russian bulletproof hoster associated with cybercrime.” Those infrastructure ties place the campaign in an established criminal hosting ecosystem, according to Huntress's analysis.
Mitigation, containment and remediation recommended by Huntress
Huntress recommended layered mitigations focused on prevention, user behavior and containment. Their specific advice includes:
- User education to reduce the chance that a target will follow the popup instruction to paste a command into Terminal.
- Installing malicious script mitigation browser add-ons such as NoScript to block the execution of embedded scripts that can present the deceptive popup.
- Using network-level blocking tools such as Pi-Hole DNS to prevent known-bad domains from resolving and thereby reduce the likelihood of the popup appearing in the first place.
- If a user follows the ClickFix exploit, immediately informing the IT team and bringing the machine into isolation mode to prevent lateral movement or data exfiltration.
Huntress noted an operational detail important for incident response: the malware “may or may not achieve persistence, but it is easily remediated by deleting any copies of the binary left behind on the machine. Once deleted, the malware will not spontaneously reconstitute itself.”
What this means for technologists, enterprises, and end users
- Technologists and security teams: Expect to see social-engineering prompts that rely on a single explicit user action (copy-and-paste into a shell). Detection and blocking of the delivery chain — the malicious domains and the Mach-O payloads — and rapid isolation when executed are the control points Huntress highlights.
- Enterprises and procurement leaders: Consumer-grade countermeasures such as browser script blockers and DNS-level filtering are cited as practical defenses; procurement decisions should consider solutions that can centrally enforce those protections for macOS endpoints.
- End users and the general public: A visually plausible CAPTCHA-like popup can be weaponized to deliver a powerful information stealer. If you are instructed to paste a command into Terminal, treat it as a security incident and contact IT immediately rather than running the command.
The campaign is a reminder that relatively simple social engineering can escalate to full credential theft and cryptocurrency draining when paired with architecture-aware payloads and criminal hosting infrastructure. Huntress’s recommendations emphasize stopping the trick before the paste, blocking the domains that serve the popups and isolating any machine that has executed the malicious command — then removing any leftover binary to fully remediate the infection.
Original reporting: https://www.infosecurity-magazine.com/news/gobased-macos-malware-crypto-and/
