Researchers have uncovered Mac malware that can steal credentials and drain all or a selected percentage of a cryptocurrency wallet, in yet another reminder not to paste random commands from the internet into Terminal.
The Go-based malware arrived through a ClickFix attack, which disguises a malicious instruction as a CAPTCHA or error message. Instead of exploiting macOS, the attackers persuaded the victim to run the command that installed their malware for them.
Once executed, a Bash script profiled the Mac and downloaded a payload built for either Apple Silicon or Intel hardware. It then deleted its temporary file, cleared the Terminal window and removed the command from shell history.
Security analysts at Huntress found the infection during a retrospective threat hunt in June on a monitored Mac that had been compromised approximately three months earlier. The security company published its findings on August 6.
Newer ClickFix campaigns have used Script Editor to work around protections Apple added for commands pasted into Terminal. The Huntress incident relied on the older Terminal method, but the payload waiting was more ambitious than the usual credential stealer.
macOS 27 adds a security feature that warns Terminal users before they paste commands copied from websites, messages or emails, and it can block scripts containing known malware. Users can still override less certain warnings, so the protection reduces the risk without eliminating it.
The malware can display a native-looking macOS dialog asking the victim for a password. It generates the prompt with osascript, a legitimate command-line tool that can produce familiar interface elements without requiring a full app.
Its most unusual component is a function called DRAIN, which looks for cryptocurrency wallet addresses and checks their balances through the associated blockchain. The code is designed to retrieve an attacker-controlled address and attempt to transfer either the entire balance or a percentage selected through a variable named DRAIN_PCT.
Separate routines cover blockchain formats used by Bitcoin, Litecoin, Dogecoin, Ethereum and XRP. Huntress also found references to Monero, though it did not identify a corresponding Monero drain routine in its published analysis.
Huntress hadn't previously seen wallet-draining malware that could steal less than the full balance. The payload calculates 1% of a wallet's value, effectively giving attackers a percentage slider for theft.
Taking only part of a balance could make the loss less obvious than immediately emptying the wallet. The code shows what the malware was built to do, however, not what its operators actually accomplished.
Huntress found no evidence that attackers successfully used the draining function. The public wallet addresses embedded in the sample had no recorded transactions or received funds when researchers checked them.
The malware didn't just target Apple users, but disguised itself as legitimate Apple software once it gained access to a Mac. The loader placed one version of the payload at $HOME/Library/Caches/com.apple.trustd/com.apple.verified, using names that resemble legitimate macOS components.
It marked the file as executable and issued a command to remove the quarantine attribute associated with software downloaded from the internet.
Huntress noted that the removal command was probably unnecessary because curl doesn't normally add a quarantine attribute. Its inclusion looks more like an extra precaution against Gatekeeper warnings.
The attackers also established persistence through an executable disguised as Software Update and a LaunchAgent named com.apple.softwareupdated.plist. The loader used launchctl to register the LaunchAgent, allowing the malware to run automatically while macOS Background Task Management tracked it as a background item.
Huntress traced the loader, payload hosting and command-and-control infrastructure to IP addresses controlled by Aeza Group.
The United States sanctioned the Russian bulletproof hosting provider on July 1, 2025, for supporting ransomware, infostealer and other cybercrime operations. The United Kingdom imposed its own sanctions on Aeza Group on November 19, 2025.
For all its credential theft, Apple impersonation and programmable cryptocurrency draining, the malware still needed the victim to open Terminal and run the command because it didn't exploit a macOS vulnerability.
The warning has become familiar by now. A legitimate CAPTCHA won't ask anyone to open Terminal, Script Editor or another system utility and execute a command copied from a website.
Anyone who followed those instructions should disconnect the Mac from the network and contact an IT administrator when applicable. Huntress said deleting the remaining malware binaries will stop them from reconstituting themselves, but it won't reverse any credential theft that already occurred.
Victims should change potentially exposed passwords from a trusted device. They should also replace any cryptocurrency wallet whose private keys or recovery phrase may have been compromised.
