ClickFix on macOS: One Pasted Command Drains Crypto Bit by Bit
A ClickFix macOS campaign analysed by Huntress ends with the victim pasting a single command into Terminal and handing over their Keychain, their browser passwords and, potentially, a slice of their cryptocurrency. The researchers published their findings on 6 August 2026 after a retrospective threat hunt in June turned up a Go-based stealer that had been sitting on a monitored Mac since March, roughly ninety days without being noticed.
How the ClickFix macOS Attack Works
The lure is the now familiar ClickFix pattern: an email with a link, a page that shows a fake CAPTCHA or a fake error, and instructions telling the visitor to "verify" themselves by running a command in Terminal. Nothing is exploited on the way in. The user is the exploit, and the command they paste does the rest.
That command fetched a Bash script from an attacker-controlled address, ran it, deleted it, then cleared the Terminal window and the shell history so nothing obvious was left behind. The script acted as a profiler and loader. It queried the hardware with tools any Mac admin would recognise, checked the processor architecture, and pulled down one of two Mach-O payloads built in Go, one for Apple Silicon and one for Intel.
What the Stealer Takes
Once running, the payload scraped the disk for files known to hold credentials. According to Huntress the haul includes browser password databases, cached credentials sitting in cookies, and data from the Apple Keychain, which on a typical Mac is the single richest target on the machine. Everything collected was sent out to an external address.
To reach the parts of the system a normal user process cannot touch, the malware used osascript to raise what looks like an ordinary macOS credential prompt, framed as a request to restore damaged system files. It is a dialog the operating system itself could plausibly have shown, and typing your password into it is what completes the compromise.
The DRAIN Function and Why Partial Theft Is New
The part that makes this sample stand out is a routine the authors named DRAIN. It looks for wallets for Bitcoin, Litecoin, Dogecoin, Monero, Ethereum and XRP, and it carries a hardcoded list of attacker-controlled addresses to send funds to.
Crypto drainers normally empty a wallet in one move, because the operator assumes they get one shot before the victim notices. This one has a DRAIN_PCT variable and per-currency logic to work out what a given percentage of the balance is worth, so it can take a cut instead of everything. Huntress says this is the first drainer they have analysed that could deliberately leave the victim their change. A wallet that quietly loses one percent looks like a fee, a rounding error or a bad memory, and a theft nobody reports is a theft that can be repeated.
Persistence and Infrastructure
The malware kept itself alive by hiding under a path that impersonates Apple's own software update components inside the user's Library folder and registering with the Background Task Management subsystem through launchctl. That is a location most people would never inspect and a name most people would never question.
The loader host, the payload server and the command-and-control endpoint all resolved to infrastructure belonging to Aeza Group, a Russian bulletproof hosting provider. Aeza was sanctioned by the United States in July 2025 and by the United Kingdom and Australia in November 2025 over its role in hosting ransomware, infostealer and other criminal operations. Despite those sanctions, the same infrastructure was still serving this campaign.
How to Protect Yourself
- Treat Terminal instructions as hostile: the single behaviour that stops this entire class of attack is refusing to paste commands you did not write and do not understand.
- Distrust unexpected password prompts: a dialog asking for your Mac password to "repair system files" out of nowhere is a red flag, and cancelling costs you nothing.
- Keep serious crypto off the daily driver: a hardware wallet keeps signing keys away from any software that manages to run on your Mac.
- Reconcile balances, not just headlines: partial draining is built to hide in the noise, so small unexplained outflows deserve the same attention as an emptied wallet.
- Filter at the DNS layer: the lure page has to load before anything else happens, and blocking it is cheaper than cleaning up afterwards.
The clipboard and the browser have quietly become the softest part of the crypto stack, and this is not an isolated case: a compromised advertising script was recently caught rewriting wallet addresses on thousands of legitimate sites, and the credentials harvested by stealers like this one end up in the same aggregated dumps that produced 24 billion leaked passwords in a single exposed database. Because the first step of the chain is always a page that has to load, network-level filtering matters more than it used to, which is why many privacy tools now bundle DNS blocklists that stop the lure before the user ever sees the fake CAPTCHA.
