ClickFix Malware Targets macOS Users in Crypto Theft Attacks

A Go-based malware delivered through ClickFix attacks is targeting macOS users, stealing cryptocurrency assets and browser-stored passwords. The malware can intercept and redirect transactions with various cryptocurrencies, allowing attackers to calculate the total value of a transaction and divert a percentage of the funds to themselves.

The malware was discovered by security researchers at Huntress after responding to a ClickFix incident. The targeted user received an email with a link to a page instructing them to run a command in Terminal, which downloaded a Bash script acting as a profiler and malware loader.

The profiler collected system information and retrieved a Mach-O payload that matched the victim's processor architecture. It also identified the account name for the currently logged-in user and created a directory named after trustd, the macOS process responsible for validating cryptographic certificates and code signatures.

The stealer payload checks the storage for files containing credentials, identified by name and extension. Browser password databases, Apple Keychain data, and cached credentials in browser cookies are all targeted. The malware can be configured to drain a certain crypto amount or remove less than the total amount from victims' wallets.