Fake CAPTCHA Tricks Mac Users Into Installing a Backdoor That Steals Passwords and Mines Crypto

Mac users are being lured into a ClickFix campaign that turns a routine CAPTCHA check into a path for password theft, remote control, and cryptocurrency mining.

It persuades a visitor to run an attackers’ command in Terminal rather than download an application. The fake verification page is styled as a TrustKey human check and displays an “I’m not a robot” box.

Selecting it silently copies a command, then instructs the victim to open Spotlight, launch Terminal, paste the supposed token, and press Return. The chain avoids the warning signs associated with a downloaded file and avoids normal Gatekeeper checks.

NetbyteSEC said in a report shared with Cyber Security News (CSN) that it investigated the macOS lure in July 2026. The pasted command fetches code from a Cloudflare Worker and runs it through macOS’s AppleScript utility, without an obvious installer.

The impact is broader than a single stolen login. The campaign installs a persistent agent, seeks the Mac login password through a fake system dialog, collects browser and wallet data, and can deploy XMRig to consume the victim’s processing power. This blend of theft and cryptomining shows the danger behind fake CAPTCHA malware loader schemes.

Fake CAPTCHA Tricks Mac Users

The first command contacts a Cloudflare Worker, which returns an encoded AppleScript payload. That script writes a LaunchAgent so the malware can restart when the user logs in, then queries a Polygon smart contract to learn where its command server is.

This method, known as EtherHiding, leaves no fixed control domain in the initial sample for defenders to block.

The loader asks it for the current server address and then contacts that address for the next stage. Because the operator can change the value on-chain, the infrastructure can move quickly.

That approach resembles an earlier EtherHiding ClickFix campaign that used blockchain storage to complicate tracking.

The infection then deploys a backdoor that identifies the device and user, checks in with the server, and asks for new tasks every minute.

Most concerningly, it presents a counterfeit macOS System Preferences prompt until the entered password works, then stores the cleartext credential locally for later theft.

Users should treat any CAPTCHA that asks them to open Terminal, Run, or another command tool as malicious. A genuine verification test does not need keyboard shortcuts to paste a token or execute a command.

Closing the page is the safest response, as ClickFix lure delivers Node.js attacks show how the same tactic can carry different payloads.

Backdoor Steals Data and Mines Crypto

The backdoor can request a full or lighter Atomic macOS Stealer, or AMOS, module. The full version searches browser profiles for saved passwords, cookies, history, wallet extensions, and encryption keys.

It also targets the macOS login keychain, Telegram data, Apple Notes, Safari information, and files in common personal folders.

The malware packages collected material into an archive and uploads it to attacker-controlled infrastructure. It can also retrieve browser safe-storage keys by repeatedly requesting keychain access, pressuring a victim to approve the prompt.

Its credential and wallet theft mirrors the macOS crash-reporting stealer threat, underscoring why Mac users should not assume the platform is immune to information theft.

A separate task installs XMRig, a legitimate mining program abused here to mine Monero for the operator. The miner is configured to use the Mac’s CPU, which can cause sustained high usage, heat, battery drain, and slower performance on affected systems.

Removing only the miner is not enough because the persistent agent can download it again. Organizations should hunt for Terminal-launched AppleScript activity, unexpected LaunchAgents, Polygon RPC requests, and fake password or keychain prompts.

Individuals who followed the instructions should disconnect the Mac from networks as soon as possible, change passwords from a clean device, and have the system professionally examined. Removing the LaunchAgent and backdoor agent is essential before restoring normal use.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC