ClickFix on macOS: one pasted command takes your Keychain

The design goal of this one is not to take everything. It's to take enough that you don't notice. Huntress analyzed a Go-based macOS infostealer delivered through a ClickFix lure, and the part that stopped their researchers cold was a routine called DRAIN that can move part of a crypto wallet balance rather than emptying it. Partial theft doesn't trigger the "wait, where did my money go" reflex. That's the innovation here, and it tells you what the operators are optimizing for.

What actually happened

Per Huntress's writeup, the incident started with an email pointing at a page that told the user to run a command in Terminal. Standard ClickFix — the whole attack is convincing a human to paste something.

That command pulls a Bash script that acts as a profiler and loader. It fingerprints the machine, then fetches a Mach-O payload matched to the processor architecture. From there it collects browser-stored passwords, cached credentials, and Apple iCloud Keychain data, then goes after wallets. The DRAIN function checks wallet addresses, queries balances, and substitutes attacker-controlled destinations during transactions. Huntress identified support for Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP, and say this is the first drainer they've analyzed that deliberately takes less than the full balance.

The staging server and command-and-control infrastructure both trace to Aeza Group, a Russian bulletproof hosting provider sanctioned by the US, UK, and Australia. BleepingComputer covered the campaign the same week.

Why this matters for your business

Skip the crypto framing for a second. Ask what else is in a macOS Keychain on a working laptop.

Wi-Fi passwords. Saved logins for your bank, your payroll provider, your registrar. App-specific passwords. Certificates. On a developer's machine: SSH passphrases, API tokens, cloud credentials, and whatever your CLI tools cached the first time you authenticated. The wallet is the headline. The Keychain is the actual loss, and it's the one you'll discover three weeks later when something else goes wrong.

Two operator moves, neither of which requires new software.

First, kill the paste habit. Every ClickFix variant — the Steam forum campaigns, the fake CAPTCHA pages, this one — depends on a person pasting a command they didn't write into a terminal they trust. That is a policy you can state in one sentence to your whole team, today: we do not paste commands from web pages or emails into Terminal, ever, and if a "fix" tells you to, that's the attack.

Second, stop treating Macs as the safe tier. If your Windows fleet has EDR, patch policy, and an inventory, and your Macs have "they're Macs," you have a monoculture of trust that attackers priced correctly a long time ago. Same controls, same coverage.

Sources: Huntress, BleepingComputer, The Hacker News.