AI Cybersecurity Threats 2026: Inside the ClickFix Go Malware Targeting macOS Crypto Wallets
A new breed of macOS malware is slipping past defenses by exploiting a social engineering trick called ClickFix — and it's not just stealing credentials. It's intercepting cryptocurrency transactions mid-flight, siphoning off configurable percentages of funds before users even sign them. Security researchers at Huntress recently uncovered this Go-based infostealer after responding to a routine ClickFix incident, and what they found was both sophisticated and unsettling.
The attack begins with a phishing email containing a link to a page that instructs the victim to run a command in Terminal. Simple enough. Familiar, even. ClickFix has been around for a while — it preys on users' willingness to follow instructions for "fixing" something broken. But this payload is different. It's written in Go, compiled for portability across architectures, and designed to do far more than most macOS malware attempts.
The ClickFix Delivery Pipeline
Here's how the malware unfolds once a user follows the link and runs the provided Terminal command. The initial stage downloads a Bash script that acts as both profiler and loader. It's a recon tool first, an attack tool second.
The profiler collects basic system information — CPU type, RAM capacity — and identifies the currently logged-in user account. Then it downloads a Mach-O payload matched to the victim's processor architecture. This isn't a one-size-fits-all approach. The malware adapts to the hardware it's running on.
What happens next is where the cleverness (and malice) really shows. The profiler creates a directory named after trustd, the macOS process responsible for validating cryptographic certificates and code signatures. It then copies the infostealing and crypto-draining payload into that directory as com.apple.verified.
Why name it that? Because it's trying to look legitimate. The malware then removes the com.apple.quarantine extended attribute from the payload, effectively bypassing Gatekeeper. No quarantine warning. No security alert. Just a clean execution path. The attacker isn't just hiding, they're impersonating Apple's own verification process.
Cryptocurrency Interception: A First for macOS
This is where the malware earns its notoriety. The Go-based payload doesn't simply empty wallets and move on. It intercepts cryptocurrency transactions before they're signed and can be configured to redirect only a percentage of the funds to the attacker's address.
Huntress researchers noted this is the first time they've analyzed a crypto drainer that doesn't necessarily drain entire wallets. The malware calculates the total value of a transaction, determines a configurable percentage to divert, and reroutes it. It's surgical. It's also designed to avoid raising suspicion, if a user sees a transaction go through with only a partial, unexplained reduction, they might chalk it up to fees or a typo.
The malware includes separate functions that determine the value of 1% of the wallet's content, depending on the cryptocurrency type. Supported assets include Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP. That's a broad net, casting wide across the cryptocurrency ecosystem.
Credential Harvesting: The Full Picture
But crypto theft is only half the story. The infostealer payload checks storage for files containing credentials, identified both by filename and extension. Browser password databases, the Apple Keychain, and cached credentials in browser cookies are all targeted.
The malware also establishes persistence and increases privileges through a particularly clever trick: it uses osascript to create a fake error dialog that prompts for an admin password. Users who comply hand over their credentials willingly, thinking they're responding to a legitimate system alert. It's social engineering dressed up as a system notification.
This dual approach, stealing what's stored and harvesting what's freshly entered, makes the malware particularly dangerous for anyone managing crypto assets on macOS. The attacker doesn't just get what's sitting in a wallet file. They get everything: passwords, cached sessions, potentially admin credentials that could unlock broader system access.
Command and Control Infrastructure
The malware communicates with shared IP addresses in Autonomous System 210644, operated by a Russian corporation known as the Aeza Group. This isn't some fly-by-night operation. Aeza Group has been sanctioned by both the US and UK governments for providing bulletproof hosting services to ransomware groups. They've built infrastructure specifically designed to resist takedowns and law enforcement pressure.
For threat actors running this malware, that's a reliable back end. The combination of Go's cross-platform compilation, the sophisticated delivery mechanism, and bulletproof hosting infrastructure suggests a well-resourced operation. This isn't a script kiddie experiment.
What Security Teams Should Watch For
Defending against this malware requires multiple layers of detection. Security teams should monitor for suspicious directories named after trustd outside of their normal system paths. Alerting on com.apple.verified signatures applied to non-Apple processes would catch the signature bypass attempt. Network monitoring for connections to AS210644 IP ranges could flag C2 communications.
Endpoint detection and response tools need to watch for osascript spawning error dialogs that request admin credentials, that's a strong indicator of privilege escalation attempts. And users should remain skeptical of any email instructing them to run Terminal commands, regardless of how legitimate the request appears.
The Bigger Picture for macOS Security
This malware represents an evolution in macOS targeting. Go-based compilation gives attackers cross-platform flexibility. The ClickFix delivery method exploits human trust in technical instructions. The crypto interception capability shows attackers are moving beyond simple credential theft to actively manipulating financial transactions.
As AI-enhanced threat actors continue refining their tradecraft, tools like this Go-based infostealer demonstrate that macOS users, often perceived as a lower-priority target than Windows users, deserve the same level of security attention. The defenses we build today need to account for malware that doesn't just steal, but actively participates in financial transactions on behalf of attackers.
Securing macOS environments against this class of threat requires vigilance at every layer: email filtering, endpoint detection, network monitoring, and user education. The ClickFix delivery model will likely persist as long as users trust instructions that ask them to run Terminal commands. That trust is earned, not given, and it's worth protecting.
