ClickFix Malware Can Slowly Bleed Your Crypto Wallet Dry
ClickFix attacks have been a growing nuisance for a while now, but a newly documented campaign targeting macOS takes things a step further. This one deploys a Go-based stealer capable of raiding cryptocurrency wallets, browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The whole thing is rather elegantly nasty.
The infection chain starts in familiar ClickFix fashion: the victim is socially engineered into pasting a command into Terminal. From there, a Bash script profiles the machine, determines its CPU architecture, and pulls down the appropriate Mach-O payload. Everything about this is deliberate and targeted.
Once running, the malware behaves like most of its macOS stealer cousins. It hoovers up browser credentials, Keychain data, and anything else left lying around. It also tries the classic fake system error prompt trick to get the user to hand over their admin password voluntarily. People still fall for this.
What makes this particular specimen stand out is a function the researchers at Huntress have labelled the DRAIN routine. Rather than simply exfiltrating wallet data for later use, the malware actively checks whether a cryptocurrency wallet contains funds and, if it does, redirects some or all of those funds to an attacker-controlled address in real time. What's genuinely novel here is that it can siphon a percentage rather than just wiping the whole thing. There are separate functions to calculate what one percent of the wallet is worth for each supported currency, which currently includes Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP. Slow bleeding rather than a smash-and-grab.
The infrastructure behind this campaign traces back to Aeza Group, a Russian bulletproof hosting operation that has already been sanctioned by the US, UK, and Australia for exactly this sort of facilitation. Nothing surprising there.
Meanwhile, the broader ClickFix ecosystem is not standing still. A separate macOS campaign has been spotted distributing MacSync and Atomic Stealer malware through a cluster of lookalike domains, with server-side browser fingerprinting to filter out sandboxes and automated analysis tools before serving the payload. Only real macOS users on real hardware get the lure. Everyone else gets nothing.
On Windows, Palo Alto Networks Unit 42 documented a variant abusing pcalua.exe, the legitimate Program Compatibility Assistant binary, to dodge parent-process detection heuristics. The attack chain involves PowerShell, WMI, a remote WebDAV share mounted over HTTPS via CDN-fronted infrastructure, and a malicious DLL loaded through rundll32. Each victim gets a unique tokenised URL, which makes bulk detection considerably harder.
Another ClickFix variant uses WebAssembly module instantiation and steganography hidden inside SVG image files to avoid network-level detection. Compromised legitimate websites run injected JavaScript that assembles the wasm module, extracts URLs, downloads SVG files, and constructs the ClickFix payload on the fly. The victim ends up on a fake verification page with a checkbox. Click the checkbox, get instructions to paste something into a Run window. Simple, effective, depressing.
Elsewhere, Lumma Stealer is turning up disguised as pirated movie releases, currently riding the coattails of The Odyssey film adaptation in 1080p WEBRip and Blu-ray flavours. A separate campaign is using cracked software and pirated game lures pushed through SEO poisoning to distribute Remus, a 64-bit Lumma variant, via fake download sites.
The throughline across all of this is that the technical sophistication is increasing while the initial attack vector remains embarrassingly low-tech. Paste this into your terminal. Click this checkbox. Download this film. The humans are still the weakest link.