ClickFix Malware Targets macOS Users with Crypto-Stealing Infostealer

A new macOS infostealer, known as ClickFix, has been discovered by researchers at Huntress. This malware is designed to steal cryptocurrency, browser passwords, Apple Keychain data, cookies, and other cached credentials from infected Macs.

The attack begins with a fake verification page that convinces users to copy a command and paste it into Terminal. Once executed, the command downloads a profiling script that identifies the Mac's hardware and retrieves a malware version designed for its processor.

The malware uses a Go-based infostealer that searches the drive for known files and locations associated with credentials. It can steal browser password databases, Apple Keychain files, browser cookies, and other cached authentication data.

The malware also has the ability to alter cryptocurrency transactions and divert either part or all of a wallet's funds. The researchers found a function named DRAIN that checks for wallet addresses, queries balances, and substitutes attacker-controlled destinations when processing transactions.