Quick Answer
A ClickFix attack active across more than 250 domains is targeting Mac users with a Go-based infostealer that steals Apple Keychain passwords, browser credentials, and cryptocurrency wallet funds. The attack works through social engineering, not a macOS flaw. The practical response is to never paste Terminal commands from a website and to update to macOS Tahoe 26.4 or macOS Sequoia for the built-in Terminal paste warning.
Key Takeaways
- Huntress published findings on August 6, 2026, describing a Go-based macOS infostealer delivered through a ClickFix social engineering attack that instructs victims to paste a command into Terminal.
- The malware includes a function named DRAIN that checks cryptocurrency wallet balances and can siphon either the entire balance or a calculated percentage, covering Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP.
- Microsoft Threat Intelligence separately documented a related campaign spanning more than 250 front-end domains that use browser fingerprinting to show malicious lures only to genuine Mac users, delivering Atomic Stealer (AMOS) and MacSync.
- The attack infrastructure runs on IP ranges belonging to Aeza Group, a Russian bulletproof hosting provider sanctioned by the US Treasury’s OFAC on July 1, 2025, for supporting ransomware and cybercrime operations.
- macOS Tahoe 26.4 and macOS Sequoia include a Terminal paste warning that alerts users before a pasted command executes, providing a direct countermeasure against ClickFix-style attacks.
What Is the ClickFix macOS Attack and Why Is It Different From Previous Threats?
The ClickFix macOS crypto wallet attack is a social engineering campaign that tricks Mac users into pasting a malicious Terminal command, which then installs a Go-based infostealer capable of stealing passwords, browser data, and cryptocurrency funds. A ClickFix scam tricked a Mac user into running a Terminal command that installed Go-based malware able to steal Keychain passwords and drain crypto wallets. What sets this threat apart from conventional macOS infostealers is the precision of its financial targeting.
The cryptocurrency component separates this malware from a conventional password stealer. Huntress identified a function named DRAIN that checks for wallet addresses, queries balances, and substitutes attacker-controlled destinations when processing transactions. That distinction matters because the malware does not simply copy stored credentials and stop. It actively intercepts outgoing transactions and redirects them.
This method depends on social engineering rather than an unpatched macOS vulnerability. The malicious website persuades the victim to run the initial command, giving the attack a way around the normal protections applied when someone downloads and opens a recognizable Mac application. For most users, that means Gatekeeper and standard download warnings offer no protection here, because the attack never delivers a conventional installer.
How Does the ClickFix Attack Actually Work on a Mac?
The ClickFix attack on macOS follows a consistent sequence. In a ClickFix attack, the computer’s user is presented with a popup window that appears to be a form of CAPTCHA prompt. The window instructs the target to copy the text of a long command string and to paste it into the Terminal application on the computer. The command string typically downloads and executes the initial stage of the attack.
In this case, that command pulled down a Bash profiler/loader that collected system details, then fetched a Mac-native Mach-O payload matched to the victim’s processor architecture. The payload is therefore tailored at delivery time to run correctly on both Apple Silicon and Intel Macs. Once executed, a Bash script profiled the Mac and downloaded a payload built for either Apple Silicon or Intel hardware. It then deleted its temporary file, cleared the Terminal window, and removed the command from shell history. Those cleanup steps are significant because they make the initial infection harder to detect after the fact.
The malware can display a native-looking macOS dialog asking the victim for a password. It generates the prompt with osascript, a legitimate command-line tool that can produce familiar interface elements without requiring a full app. That technique allows the malware to harvest macOS account credentials without any visible third-party software appearing on screen.
Components had been present on a monitored Mac infected several months earlier, showing how a successful ClickFix attack can remain unnoticed after the deceptive webpage has closed. Closing the page or deleting the original email does not remove a payload that has already executed and established persistence. This is a key practical limitation: removing the phishing email after the fact does not undo the infection.
What Cryptocurrency Wallets and Data Does the Malware Target?
A Go-based malware delivered in ClickFix attacks targeting macOS users is stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. The malware can intercept and redirect transactions with various cryptocurrencies.
Among the targeted cryptocurrency assets are Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple’s XRP. The breadth of supported networks means the risk is not limited to holders of any single coin. Although it can empty wallets entirely, it can also calculate the total value of a transaction to determine how much to divert to the attacker.
Huntress stated: “While this may not be a brand new feature, it’s the first time we have seen malware capable of emptying a cryptocurrency wallet that could be used to remove any less than the entire wallet’s value.” That behavior has a deliberate stealth rationale. The code includes functions to calculate the total transaction amount and quietly divert only a set percentage to the attacker’s address. This allows the actors to remain on the victim’s accounts without arousing immediate suspicion. A user who does not monitor wallet balances closely may not notice the loss for days or weeks.
Beyond cryptocurrency, the malware collects and exfiltrates data including media files, iCloud data and Keychain entries, and cryptocurrency wallet keys. In some campaigns, the malware replaces legitimate cryptocurrency wallet apps with trojanized versions, putting users at an added security risk.
How Are the 250-Plus Domains Hiding the Attack From Security Researchers?
A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download.
Microsoft Threat Intelligence said the campaign checks visitors for signs of a genuine Mac before serving malicious instructions that can lead to the download of Atomic Stealer or MacSync. Crawlers, sandboxes, and researchers may instead receive blank pages or benign-looking decoys, making the infrastructure harder to detect and investigate. The practical consequence is that automated security scanning tools are much less reliable at identifying and blocking these domains than they would be against a conventional phishing page.
The front-end infrastructure relies on algorithmically generated, dictionary-style names that frequently include a “file” token, such as filecopperbasket, filevelvettractor, fileoceanhammer, and filemarblegarden, as well as variants like applefilevault, bananafastfile, and orangesmartfile. These domains masquerade as legitimate download portals, presenting GitHub-themed “Download for macOS” pages with forged “Verified Publisher” badges to selected visitors, while serving blank, parked, or decoy content to everyone else.
Microsoft said the wider cluster distributed MacSync and Atomic Stealer (AMOS); the chain it analyzed through the gate ended in AMOS. Microsoft’s analysis was published on August 5, 2026, and Microsoft has not disclosed victim numbers, targeted sectors, or the identity of the operators.
Who Is Behind the Attack Infrastructure?
According to Huntress, the malware communicates to shared IP addresses in Autonomous System (AS) 210644, which is “operated by a Russian corporation known as the Aeza Group.” The connection to Aeza Group is significant because of the company’s established profile as a criminal hosting provider.
The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced sweeping sanctions on July 1, 2025, against Aeza Group, a Russia-based bulletproof hosting provider, for facilitating a wide range of cybercriminal activities worldwide. The move, coordinated with the United Kingdom’s National Crime Agency (NCA), also targeted Aeza’s network of affiliated companies and four senior executives, underscoring a transatlantic effort to disrupt the infrastructure underpinning ransomware, data theft, and illicit online drug markets.
According to OFAC, Aeza Group provided bulletproof hosting services to ransomware and malware groups such as the Meduza and Lumma infostealer operators, who used the hosting service to target US defense and technology companies, among other victims globally. The fact that the ClickFix macOS campaign’s command-and-control servers sit on Aeza infrastructure after US and UK sanctions indicates the group continues to operate despite those designations.
What Protection Does macOS Offer Against ClickFix Attacks?
macOS Tahoe 26.4 and macOS Sequoia include a built-in Terminal paste warning designed specifically to interrupt ClickFix-style attacks. Mac users are encouraged to update to the latest macOS Tahoe 26.4 or macOS Sequoia, which introduces a native terminal security warning designed to alert users when they are being tricked into pasting potentially malicious commands.
When a user copies text that contains shell commands or executable code and attempts to paste it into Terminal, the system now presents an explicit warning dialog describing what the pasted content will do and asking the user to confirm they understand the risk. That intervention targets the exact moment at which persuasion converts to execution, which is the point where the attack succeeds or fails.
That said, the protection has documented limits. Newer ClickFix campaigns have used Script Editor to work around protections Apple added for commands pasted into Terminal. The Huntress incident relied on the older Terminal method, but the payload waiting was more ambitious than the usual credential stealer. Apple’s warning is a meaningful friction layer, not a complete barrier, particularly as attackers adapt delivery methods to bypass it. Terminal shows a confirmation prompt for users who have not opened it in more than 30 days, lack common developer tools, and paste from browsers or messaging apps. Separately, XProtect can trace commands pasted into any terminal emulator, inspect their process tree and network artifacts, and block activity associated with known malware.
What Should Mac Users Do Right Now?
The most important step is to never paste a Terminal command that originated from a website, an email link, or a pop-up prompt, regardless of how official the page looks. These scams don’t rely on zero-day exploits or malware downloads. They exploit human trust: users encounter a convincing fake page, often via malicious Google Ads or sponsored results, claiming a problem like “your Mac is infected” or “complete human verification.” No legitimate software installer, software verification page, or CAPTCHA requires you to open Terminal and paste a command.
Beyond that behavioral change, the following steps provide layered protection. Update to macOS Tahoe 26.4 or macOS Sequoia immediately if you have not done so, because the Terminal paste warning is present in those releases. Move any significant cryptocurrency holdings into a hardware wallet that requires physical confirmation for every outgoing transaction, since software wallet keys stored on a compromised Mac can be read and used by this malware. Review your Apple Keychain and any browser-saved passwords for accounts with financial access, because the same infostealer targets those credential stores. If you believe your Mac was already compromised, do not simply delete the phishing email or close the browser tab. Contact a professional or your organization’s IT security team before attempting removal, because the malware establishes persistence after execution.
For security teams managing fleets of Macs, defenders should watch for browsing followed by unusual Terminal activity, especially curl piped to zsh, Base64 decoding, osascript, and file creation followed by outbound HTTP POST requests. Those behavioral signals are the most reliable indicators of a ClickFix infection in a managed environment.
ClickFix macOS Attack: What It Steals and How Each Method Works
| Target | How the Malware Accesses It | Risk to User |
|---|---|---|
| Crypto wallet funds | DRAIN function queries balances and substitutes attacker wallet address during transactions | Partial or total balance loss; partial theft may go undetected for weeks |
| Apple Keychain | Mach-O payload reads Keychain entries after collecting macOS account password via fake osascript dialog | Exposure of all stored passwords, including banking and email credentials |
| Browser-stored passwords and cookies | Infostealer reads browser credential stores and session cookies | Account takeover; session cookies can bypass multi-factor authentication |
| iCloud data | Payload exfiltrates iCloud Keychain entries and cached data | Exposure of synced passwords and files across Apple devices |
| Wallet app integrity | Some campaign variants replace legitimate wallet apps with trojanized versions | Every future transaction made through the replaced app is intercepted |
For broader context on the supply-chain and credential-theft risks that affect developers and general users alike, see The ChainDrop npm Worm Hit 444 Packages With 2 Billion Monthly Downloads: What Developers Need to Know. For a related look at how fake apps and scam tools exploit macOS and mobile users, see That ‘Free ChatGPT’ App Might Be a Scam: How to Spot Fakes and The Fake CAPTCHA Scam: How ‘Verify You’re Human’ Installs Malware. If you use Windows and want to understand how update-related security changes affect your system, Windows 11 August 2026 Update (KB5101684): New Features and How to Get It covers the latest patch cycle.
FAQ
Does the ClickFix macOS attack exploit a security flaw in macOS?
The ClickFix macOS attack does not exploit an unpatched macOS vulnerability. This method depends on social engineering rather than an unpatched macOS vulnerability. The attack succeeds only if the user copies and pastes the malicious command into Terminal and confirms execution, which is why behavioral caution is the primary defense.
Which cryptocurrencies are at risk from the DRAIN function?
Among the targeted cryptocurrency assets are Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple’s XRP. Any software wallet for these currencies whose keys are stored on a Mac could be accessed if the device is infected. Hardware wallets that require physical transaction approval on the device itself are not vulnerable to remote transaction redirection in the same way.
Will updating macOS fully protect against ClickFix attacks?
Updating to macOS Tahoe 26.4 or macOS Sequoia adds a meaningful Terminal paste warning, but it does not fully eliminate the risk. Newer ClickFix campaigns have used Script Editor to work around protections Apple added for commands pasted into Terminal. The update reduces the likelihood of infection for a typical user but should be combined with the behavioral rule of never pasting website-supplied commands into Terminal.
How do I know if my Mac is already infected?
Infection may leave few obvious signs because the malware deletes its loader and clears shell history after execution. The most reliable indicators are unexplained outbound network connections from Terminal-related processes, unfamiliar login items under System Settings, a macOS password prompt appearing outside any normal login context, or cryptocurrency wallet balances that do not match your transaction history. If you suspect infection, contact a professional security firm rather than attempting manual removal, because the malware establishes persistence that can survive simple file deletion.
Is it safe to use Terminal normally after this news?
Terminal itself is safe to use for legitimate purposes. The risk is specific to commands that originate from websites, emails, pop-up prompts, or any external source instructing you to paste something. These infostealers remain a critical threat because stolen session cookies allow attackers to bypass multi-factor authentication by hijacking active sessions. Legitimate software tools, developer environments, and system administration tasks do not require you to copy a command from a webpage and paste it into Terminal without reviewing it first.