Researchers at Huntress have uncovered a strain of macOS malware that can gradually siphon funds out of victims’ cryptocurrency wallets, after tracing an infection back to a fake CAPTCHA scam known as ClickFix.
The incident came to light during a retrospective threat hunt in June 2026, when a Huntress analyst discovered remnants of a Mac-specific stealer on a system that had actually been compromised three months earlier. The victim had been served a pop-up disguised as a routine CAPTCHA check, instructing them to copy a command and paste it into the Mac Terminal application – a social engineering technique the security vendor says has surged in popularity in recent years.
Once executed, the command quietly pulled down a Bash loader that fingerprinted the machine before fetching a Go-based Mach-O payload tailored to the device’s processor architecture. The malware was built to harvest credentials from the Apple Keychain, browser password stores and cached browser cookies. To avoid detection, it wrote itself into a folder disguised as a legitimate Apple system process and stripped the file of the quarantine flag that would normally trigger a Gatekeeper security warning.
The malware’s standout feature, according to Huntress, is a function it calls DRAIN, which checks whether a detected cryptocurrency wallet holds a balance and, if so, transfers either a set percentage or the entire amount to a wallet controlled by the attacker. The code included dedicated routines for Bitcoin, Litecoin, Dogecoin, Ethereum and XRP, along with variables to calculate what a given percentage of a wallet’s contents would be worth – allowing operators to bleed a wallet dry incrementally rather than emptying it in one obvious transaction. Huntress noted this is the first time it had observed wallet-draining malware built to remove a controlled fraction of funds rather than the full balance outright.
Investigators also found the attackers used an osascript-generated dialogue box to trick the victim into re-entering their system password, granting the malware elevated privileges without raising suspicion.
Infrastructure analysis tied the loader, payload hosting and command-and-control server to IP address ranges operated by Aeza Group, a Russian bulletproof hosting provider. Aeza Group was sanctioned by the US Treasury’s Office of Foreign Assets Control in July 2025, with the UK and Australia joining a further round of sanctions against ransomware infrastructure providers in November 2025.
Huntress is urging organisations to treat ClickFix-style prompts as a red flag and to train staff never to paste unknown commands into a terminal window. The firm also recommends malicious-script mitigation browser extensions and DNS-level blocking of known-bad domains as additional layers of defence, alongside immediate isolation of any machine where a ClickFix command has been run.
The company has published indicators of compromise, including file hashes and the IP addresses involved, via its GitHub threat-intelligence repository.
You can read more here: https://www.huntress.com/blog/mac-crypto-draining-malware
