This MacOS ClickFix Scam Doesn’t Just Steal Your Crypto, It Takes a Cut and Leaves the Rest
Published
Key Takeaways
- Root cause: A ClickFix scam tricked the victim into pasting a malicious command into the macOS Terminal.
- Key capability: A DRAIN function siphons cryptocurrency wallet balances to attacker-controlled addresses.
- Infrastructure link: The malware traced back to Aeza Group, a sanctioned Russian bulletproof hosting provider.
A macOS malware campaign steals credentials and drains cryptocurrency wallets, tracing the infection to a ClickFix social engineering scam. A Huntress report details an incident uncovered during a June 2026 retrospective threat hunt on a system that had actually been infected three months earlier.
All components – the initial loader, payload hosting, and command-and-control (C2) server – tied back to infrastructure operated by Aeza Group (AS210644), a Russian bulletproof hosting provider known for serving organized cybercriminal and ransomware groups.
ClickFix Scam Kicks Off the Attack Chain
The victim followed a link, then encountered a fake CAPTCHA popup instructing them to paste a command into Terminal. The command pulled and executed a file and wiped the Terminal history in the same move.
That Bash script profiled the system down to the hardware serial number and CPU details, created a directory mimicking the legitimate macOS certificate process.
It then retrieved a Mach-O payload matched specifically to the victim's CPU architecture. The domain profitnow[.]io was used during the ClickFix phase.
Go-Based Stealer Targets Keychain and Crypto
Written in Go and obfuscated with a tool called Go Garbler, the Mach-O stealer established persistence by disguising itself as a legitimate macOS update-checking process and registering with Background Task Management.
Then, it prompted for the victim's password through a fake system dialog built with osascript – a legitimate macOS scripting tool capable of mimicking native system prompts.
DRAIN Function Empties Wallets Slowly
Mach-O scrapes browser password stores, the Apple Keychain, and cached credentials from browser cookies. The stealer's broader cryptocurrency-theft capability targets Bitcoin, Litecoin, Dogecoin, and Monero, intercepting and redirecting transaction data outright.
Its DRAIN function goes further: it identifies wallet addresses tied to Bitcoin, Litecoin, Dogecoin, Ethereum, and XRP, queries the blockchain for balances, and redirects either a portion or the full amount to attacker wallets.
Huntress noted this partial-theft capability is itself notable: rather than draining a wallet all at once, the malware can be tuned to skim a percentage at a time, making the theft harder to notice. Yet, no confirmed victim losses have been documented.
Aeza Group Infrastructure Under Sanctions
The report notes that this may not be a brand new feature, but “it's the first time we had seen malware capable of emptying a cryptocurrency wallet that could be used to remove any less than the entire wallet's value," the researchers said.
The U.S. Treasury's Office of Foreign Assets Control sanctioned Aeza Group in July 2025, with the U.K. and Australia joining those sanctions in November 2025.
The U.S. sanctioned Russian hosting providers Media Land for supporting LockBit, BlackSuit, and Play Ransomware and Aeza for providing bulletproof services to the Russian disinformation agency Social Design Agency. The latter was sanctioned by the U.K. in 2024 for its “attempts to destabilize Ukraine and undermine democracies globally.”
Mitigation Advice
Huntress offers the following advice:
- install malicious-script-blocking browser extensions like NoScript,
- use DNS-blocking tools like Pi-hole to prevent known-bad domains from resolving,
- invest in user education about ClickFix-style fake CAPTCHA popups.
- Immediately notify IT, isolate the machine, and delete any copies of the binary left behind if infected, since it doesn't self-replicate.
A July report outlined that the new Dolphin X Windows stealer uses AI to rank which victims are worth robbing. In August 2025, ClickFix Fake CAPTCHA campaigns showed enhanced cross-platform tactics targeting macOS and Linux.
In 2024, researchers observed that a Linux Hadooken malware campaign targeting Oracle WebLogic for crypto-mining leveraged IP addresses registered under Aeza.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular