Go-Based macOS Malware Targets Crypto and Credentials via Social Engineering
A new Go-based malware campaign, distributed through 'ClickFix' social engineering tactics, is targeting macOS users to steal cryptocurrency and sensitive credentials.
Security researchers have identified a new Go-based malware campaign specifically targeting macOS users, employing sophisticated social engineering tactics to compromise systems and exfiltrate valuable data. The malware, discovered in June 2026 by managed detection and response (MDR) specialist Huntress, is delivered through a technique known as 'ClickFix' attacks.
In a ClickFix attack, users are presented with a deceptive popup window that mimics a CAPTCHA prompt. This window instructs the unsuspecting victim to copy a lengthy command string and paste it into their macOS Terminal application. This seemingly innocuous action is the initial stage of the malware's execution, designed to trick users into running malicious code.
Once the command is executed, it typically downloads and runs a Bash profiler or loader. This initial stage collects system details and then fetches a Mac-native Mach-O payload. Crucially, this payload is tailored to the specific processor architecture of the infected victim's machine, ensuring its effectiveness.
The Go-based stealer payload is designed to systematically scrape sensitive information from the infected system. This includes data stored in browser password managers, Apple's Keychain, and other cached credentials. The malware's objective is to gather as much personal and professional information as possible for later exploitation.
Adding to its malicious capabilities, the malware features a 'DRAIN' function. This component can check cryptocurrency wallets for the presence of funds. If assets are detected, the malware can then redirect all or a portion of the balance to cryptocurrency wallets controlled by the attackers, directly siphoning digital wealth.
Further investigation by Huntress linked the loader, payload hosting infrastructure, and command and control (C2) communications back to the Aeza Group. This entity is a sanctioned Russian bulletproof hoster with known associations to various cybercrime operations, underscoring the organized nature of this threat.
To mitigate these ClickFix threats, Huntress recommends a multi-pronged approach. User education is paramount to help individuals recognize and avoid social engineering tactics. Additionally, installing browser add-ons like NoScript can block malicious scripts, and network-level defenses such as Pi-Hole DNS can prevent known malicious domains from resolving, thereby reducing the chances of popups appearing.
If a user inadvertently falls victim to a ClickFix exploit, Huntress stresses the importance of immediate notification to the IT team and isolating the affected machine. While the malware may or may not achieve persistence, it can be remediated by simply deleting the malicious binary files, as it does not self-reconstitute.