A new malware campaign targeting macOS users deploys a Go-based stealer that can gradually drain cryptocurrency wallets, siphoning portions of their value to attacker-controlled accounts, according to a report published by Huntress. The malicious software, distributed through ClickFix-style attacks, also captures browser-stored passwords, Apple iCloud Keychain information, and cached system credentials. The infection begins when victims paste a ClickFix command into the Terminal app, which launches a Bash script that gathers detailed system information before downloading a payload tailored to the victim's CPU architecture.
The malware's distinctive feature is a "DRAIN" routine that checks whether a cryptocurrency wallet contains funds and, if it does, redirects a portion or all of it to wallets under the attacker's control. The stealer includes separate functions targeting Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP. Like other macOS stealers, the malware tries to gain elevated privileges by displaying a fake prompt that asks victims to enter system credentials, claiming an "unexpected system error" requires restoring damaged system files. The command-and-control infrastructure and payload-hosting servers trace back to Aeza Group, a Russian bulletproof hosting provider sanctioned by the U.S., U.K., and Australia for enabling malicious actors.
According to Huntress security researcher Andrew Brandt, "While the malware payload is capable of stealing passwords, its most interesting function is its capability to slowly deplete cryptocurrency accounts." The report notes this marks the first time researchers have observed malware capable of removing less than a wallet's entire value. "The malware contained separate functions to determine just how much 1% of the wallet's contents is worth, depending on which cryptocurrency the malware targets," Huntress stated.
The disclosure arrives as multiple ClickFix attack variants have emerged in recent weeks, including a macOS campaign distributing MacSync and Atomic Stealer through look-alike domains with server-side browser fingerprinting to serve lures only to legitimate macOS browsers while blocking analysis tools. Another variant abuses Windows' Program Compatibility Assistant to spawn PowerShell, mount remote WebDAV shares, and load malicious DLLs, according to Palo Alto Networks Unit 42. A third campaign uses on-the-fly WebAssembly module instantiation and steganography through SVG images to evade network detection, building ClickFix URLs through compromised websites running injected JavaScript. The partial-drain capability represents a tactical shift that may allow attackers to operate undetected for longer periods, exploiting victims who don't monitor wallet balances closely enough to notice incremental losses rather than complete theft.
Organizations and individual users face a growing challenge in distinguishing sophisticated social engineering attacks from legitimate system prompts, particularly as attackers refine techniques to bypass automated defenses and target high-value cryptocurrency holdings. The convergence of credential theft and precision wallet drainage suggests threat actors are evolving toward more patient, strategic monetization approaches rather than rapid smash-and-grab operations.