Copy this command into Terminal and the problem fixes itself. That single instruction has become one of the most reliable ways to compromise an Apple computer. Researchers at Huntress traced a ClickFix campaign spreading macOS malware written in Go. The payload handles two jobs at once. It collects stored credentials, then reroutes cryptocurrency payments to the attacker before the owner notices.
The technique works because the victim performs every risky step by hand. There is no exploit to detect and no suspicious download to block. As a result, tools that watch for automated activity have very little to catch.
How the ClickFix Attack Plants macOS Malware
In this campaign, the chain starts with an email carrying a link to a page under the attacker’s control. That page tells the visitor to run a short command in Terminal, framed as a quick fix. Running it pulls down a Bash script that works as both a profiler and a loader.
The script reads hardware details such as CPU and RAM. Then it fetches a Mach-O binary matching the machine’s processor architecture. It also grabs the logged-in account name, then creates a folder named after trustd, the process that validates certificates and code signatures. Next it copies the payload into that folder under the filename com.apple.verified.
One extra step makes this ClickFix delivery of macOS malware run without friction. The script strips the com.apple.quarantine attribute from the file. Gatekeeper depends on that attribute to flag web downloads, so removing it kills the security alert.
A Fake Error Message Opens the Door
Elevated access comes from a second piece of theater. The malware calls osascript, a scripting tool built into macOS, to display a fake system error. The box asks for the administrator password, and plenty of people type it in without a second thought.
That password does the rest of the work. With it, the malware sets up persistence and raises its own privileges beyond what a standard account allows.
What the Stealer Collects
Wallets are not the only prize. The ClickFix campaign carrying this macOS malware also goes after everyday logins. Once running, the payload sweeps storage for anything holding credentials, picking targets by filename and by extension.
In practice, browser password databases sit at the top of the list. The Apple Keychain follows, along with cached credentials inside browser cookies. Those three sources alone can expose email, cloud storage, work logins, and exchange accounts in one pass.
The Crypto Drainer That Leaves Money Behind
The financial side is where the macOS malware from this ClickFix campaign breaks from the standard playbook. Rather than hunting for wallet files to copy, it edits transactions before they reach the signing stage. The victim approves what looks like a routine payment, and the funds land somewhere else.
Most drainers empty a wallet and move on. This one, however, can be set to take only a slice. Researchers found dedicated functions that calculate 1% of a wallet’s holdings, depending on the coin. Huntress described it as the first drainer the team had analyzed that could deliberately leave money behind.
That design makes sense from the attacker’s point of view. An emptied wallet triggers an immediate reaction, including password changes and public warnings. A wallet running a few percent light after each transfer can go unnoticed for months. Targeted assets include Bitcoin, Ethereum, Litecoin, Dogecoin, Monero, and XRP.
Traffic Points to a Sanctioned Host
Infected machines send traffic to shared IP addresses inside Autonomous System 210644. That block belongs to Aeza Group, a Russian hosting company.
Aeza and several individuals linked to it already carry sanctions from the United States and the United Kingdom. Authorities named the company as a bulletproof hosting provider, meaning it kept ransomware crews online and ignored abuse complaints. Those sanctions have clearly not pushed the infrastructure offline.
Defending Against ClickFix Attacks and macOS Malware
A handful of habits break this chain early.
- Treat any web page that asks you to paste a command into Terminal as hostile. Real software fixes never arrive that way.
- Close unexpected admin password prompts, then check which application asked for the credentials.
- Move crypto holdings to a hardware wallet that displays the destination address on its own screen.
- Verify the recipient address character by character before you sign a transaction, even a small one.
- Stop saving passwords in the browser and switch to a password manager with a separate master password.
Network hygiene matters as well. Many of these lure pages reach people through malvertising, poisoned search results, and hacked websites. A VPN with built-in ad and tracker blocking cuts down how many of those pages ever load. It also keeps your traffic off networks you do not control. Paired with a password manager and a hardware wallet, it narrows the space where ClickFix attacks reach macOS with malware.
Final Thoughts
Apple users spent years hearing that malware was somebody else’s problem. Campaigns like this one settle the argument. The ClickFix route to installing macOS malware needs no zero-day and no signed installer. It only needs a person willing to follow instructions from a web page.
The partial-drain capability deserves attention far beyond the Mac world. Attackers who take 1% and stay quiet earn more over time than attackers who take everything and get caught fast. That logic will spread to other platforms and other wallet-stealing families.
For now, the defense is behavioral. Slow down when something asks for your admin password. Confirm where your crypto is actually going, and keep Terminal closed unless you opened it yourself.
