A new malware campaign targets macOS users through ClickFix-style social engineering attacks. The infection chain delivers a Go-based stealer that exfiltrates cryptocurrency wallets, browser passwords, Apple iCloud Keychain credentials, and cached authentication data.
The attack begins with social engineering that directs victims to malicious websites mimicking legitimate support pages. Users receive prompts to download files presented as system fixes or security updates. The initial payload is a shell script that profiles the target system and identifies its CPU architecture. Based on this profiling, the script fetches a compiled Go malware binary compatible with the victim's processor.
Once executed, the stealer accesses stored credentials across multiple vectors. It targets cryptocurrency wallet applications and browser-based wallet extensions, making it particularly dangerous for users who store digital assets locally or in browser extensions. The malware also harvests passwords saved in browsers like Chrome, Firefox, and Safari, along with credentials stored in Apple's iCloud Keychain, which syncs passwords across macOS and iOS devices. Cached credentials from system authentication mechanisms are also extracted.
The ClickFix social engineering tactic has proven effective on Windows systems and now extends to macOS, indicating threat actors are expanding their platform coverage. The use of a Go-based payload provides cross-platform compilation flexibility and obfuscation advantages over traditional interpreted languages.
Organizations with macOS users should implement security awareness training focused on suspicious download prompts and fake support sites. Users should verify system alerts through official Apple channels and avoid downloading files from unsolicited web prompts. Endpoint detection tools capable of identifying unusual credential access patterns and Go-compiled binaries offer additional protection layers. Password managers with strong isolation mechanisms and hardware wallet devices for cryptocurrency storage reduce exposure to this specific threat.