A new macOS infostealer, delivered through "ClickFix" attacks, is targeting cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. The malware, written in Go, has the capability to intercept and redirect cryptocurrency transactions, either fully draining wallets or diverting a percentage of funds to the attacker.
Security researchers at Huntress discovered the payload during an incident response. The attack begins with a targeted email containing a link that directs the user to a page instructing them to execute a command in Terminal. This command downloads a Bash script that acts as a profiler and malware loader.
The Bash script first collects system information, such as CPU and RAM details. It then retrieves a Mach-O payload specifically matched to the victim system's processor architecture. The profiler also identifies the currently logged-in user's account name and creates a directory named "trustd," a reference to the macOS process responsible for validating cryptographic certificates and code signatures.
The infostealing and crypto-draining payload is then copied into this newly created directory as "com.apple.verified." To bypass macOS Gatekeeper security alerts, the script removes the "com.apple.quarantine" extended attribute from the file.
For persistence and privilege escalation, the malware employs the `osascript` utility to create a fake error dialog box, prompting the user for their administrator password. Once executed, the stealer payload scans the system for files containing credentials, identifying them by both name and extension. This includes browser password databases, the Apple Keychain, and cached credentials stored in browser cookies.
A notable feature of this Go-based malware is its ability to modify cryptocurrency transactions before they are signed. It can be configured to redirect only a percentage of the funds to the attacker, rather than the entire amount. Huntress researchers observed functions within the malware that calculate the value of 1% of a wallet's content, tailored to specific cryptocurrency types.
Cryptocurrencies targeted by the malware include Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP. The malware communicates with command-and-control servers via shared IP addresses within Autonomous System (AS) 210644, which is operated by the Aeza Group, a Russian corporation. The Aeza Group and its affiliates have been sanctioned by the US and UK for providing "bulletproof hosting" services to ransomware groups.
