"Browser password databases, the Apple Keychain, and cached credentials in browser cookies are all targeted," Huntress says.
How the ClickFix lure delivered a Go-based macOS payload
Managed Detection and Response (MDR) services company Huntress discovered the malware after responding to a ClickFix incident in which the targeted user received an email containing a link. That page instructed the recipient to run a Terminal command. Executing the command downloaded a Bash script that acted as a profiler and loader: it collected system information such as CPU and RAM and then retrieved a Mach-O payload matched to the victim system’s processor architecture.
Persistence, privilege escalation, and Gatekeeper bypass
The Bash profiler also identified the currently logged-in account name and created a directory named after trustd, the macOS process responsible for validating cryptographic certificates and code signatures. Huntress found the payload copied into that directory under the filename com.apple.verified. Before execution, the malware removed the com.apple.quarantine extended attribute so macOS Gatekeeper would not show a quarantine warning.
According to Huntress’ analysis, the malware establishes persistence and increases privileges by collecting system credentials via a fake error created using the osascript utility. Those behaviors are part of the loader’s effort to remain active and operate with elevated access on the infected host.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleInfostealing plus a configurable crypto drain
Huntress describes a combined infostealer and crypto-drainer written in Go. The stealer component searches storage for files containing credentials, looking both at file names and file extensions. The company’s analysis explicitly lists three credential sources targeted: browser password databases, the Apple Keychain, and cached credentials held in browser cookies.
Beyond harvesting credentials, the malware includes code that modifies cryptocurrency transactions before they are signed. Huntress observed that the drainer can be configured in multiple ways: it can empty wallets entirely, or it can calculate the total value of a transaction and divert only a percentage of the funds to the attacker. The researchers note this is the first time they analyzed a crypto drainer that did not necessarily drain a wallet completely but could be configured to remove less than the total amount.
Huntress also observed separate functions that determine the value of 1% of a wallet’s content, with logic that varies by cryptocurrency type.
Which assets are at risk and where the malware calls home
The malware targets multiple cryptocurrency assets named in the analysis: Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP. Network indicators noted by Huntress show the malware communicating to shared IP addresses in Autonomous System (AS) 210644. Huntress reports that AS 210644 is operated by a Russian corporation known as the Aeza Group, a company and individuals affiliated with which have been sanctioned by the US and the UK for providing bulletproof hosting services to ransomware groups.
What this means for technologists, incident responders, and end users
- Technologists and security teams: Huntress’ findings identify explicit artifacts — a trustd-named directory containing a com.apple.verified binary and removal of com.apple.quarantine — that can be searched for during triage. The combination of a Mach-O payload matched to host architecture and osascript-driven fake errors signals mixed persistence and social-engineering techniques to elevate privileges.
- Incident responders: The dual capability to steal credentials (browser DBs, Keychain, cookie caches) and to alter transactions before signing complicates recovery. Huntress’ observation that the drainer can divert only a percentage of a transfer introduces new forensic considerations when reconstructing thefts and determining attacker intent.
- End users: The initial vector reported by Huntress was an email with a link that led to an instruction to run a Terminal command. That sequence illustrates how a single click followed by an executed command can pull a tailored Mach-O payload into a macOS environment.
Huntress’ analysis documents a shift in technique: attackers are not limited to entirely emptying wallets and instead can siphon configurable percentages, while also pairing that capability with broad credential theft. The combination — targeted credential harvesting plus transaction modification logic — makes this ClickFix-delivered Go-based malware a hybrid threat that touches both account takeover and direct asset diversion. Huntress’ report and the network and file indicators it contains offer concrete starting points for detection and response.
