A Go-based malware delivered in ClickFix attacks targeting macOS users is stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials.
The malware can intercept and redirect transactions with various cryptocurrencies. Although it can empty wallets entirely, it can also calculate the total value of a transaction to determine how much to divert to the attacker.
Security researchers at Managed Detection and Response (MDR) services company Huntress discovered the payload after responding to a ClickFix incident.
The targeted user received an email with a link to a page instructing them to run a command in Terminal.
This downloaded a Bash script acting as a profiler and malware loader that collected system information (e.g., CPU, RAM) and retrieved a Mach-O payload that matched the victim system’s processor architecture.
