Summary
- A ClickFix lure led to a Go-based macOS stealer targeting Keychain, browser data, and other locally stored credentials.
- The malware included functions capable of diverting either all or a configurable percentage of supported cryptocurrency balances.
- Huntress linked loader, payload, and command-and-control infrastructure to address space operated by sanctioned Aeza Group.
A macOS credential stealer investigated by Huntress contains an unusual capability to drain only part of a cryptocurrency balance, combining financial theft with malware designed to collect identities and browser data from Apple systems.
Huntress found components of the malware during a retrospective threat hunt in June. The monitored Mac had been infected around three months earlier after its user encountered a ClickFix social-engineering lure.
The attack began with a link in an email leading to a fake verification prompt. The victim was instructed to paste a command into Terminal, allowing the attacker to turn social engineering into local code execution without first exploiting a macOS vulnerability.
The command downloaded a shell-based loader that profiled the machine and selected a native payload according to processor architecture. Huntress identified the final malware as a Go-based Mach-O binary.
The payload searched Apple Keychain data, browser credential stores, cookies, and other locally cached information. Those capabilities place it within the growing class of information stealers targeting macOS users who hold access to both personal and enterprise services.
The cryptocurrency functionality is more distinctive. Huntress identified a function capable of checking balances and redirecting supported assets towards attacker-controlled addresses.
A configuration value allowed the malware to calculate a percentage of the available balance rather than moving all funds. The researchers found handling for several cryptocurrency formats and said this was the first time they had observed malware designed to take less than an entire wallet balance in this way.
That capability should not be confused with evidence of successful wallet theft in the investigated case. Huntress checked the publicly visible hard-coded destination addresses it identified and found no recorded funds or transactions at the time of analysis.
The malware therefore demonstrates the capability and developer intent to drain cryptocurrency, including incrementally, while the available evidence does not establish that the feature successfully stole assets from victims.
The attack infrastructure provides a separate link to the cybercrime market. Huntress traced systems involved in hosting the loader, malware payloads, and command-and-control activity to address space operated by Aeza Group.
Aeza is a Russian bulletproof-hosting provider that was sanctioned by the United States in July 2025 and later subjected to UK and Australian sanctions. Such infrastructure has been associated with services used by organised cybercriminals and ransomware operations.
Use of Aeza infrastructure does not establish that Aeza personnel conducted this intrusion, nor has Huntress attributed the malware campaign to the hosting provider. The connection concerns infrastructure supplied from Aeza-controlled address space.
The incident overlaps with a wider rise in macOS malware targeting identity stores, although the percentage-based wallet logic and Aeza infrastructure give the new research a distinct technical angle.
The enterprise exposure remains centred on the credentials rather than cryptocurrency. Apple Keychain entries, browser sessions, and stored passwords can provide access to SaaS platforms, development environments, cloud consoles, messaging tools, and other corporate services if the compromised Mac is also used for work.
A personal-looking ClickFix lure can consequently become an organisational identity incident without the attacker needing to exploit the employer directly. The endpoint provides the execution environment, while the stolen credentials determine how far the compromise can extend.
The attack also illustrates why macOS targeting increasingly follows the same commercial logic seen on Windows. The value is not necessarily the device itself. It is the collection of credentials, sessions, developer access, and financial information that accumulates around a workstation used for everyday digital activity.
In this case, the crypto-draining capability is technically unusual, but the broader chain is familiar: persuade the user to run the first command, profile the endpoint, harvest valuable identities, and use criminal infrastructure to move the resulting data beyond the machine.
