The malware, written in the Go programming language and compiled as a native Mach-O executable, can steal browser credentials and cached authentication data while also manipulating cryptocurrency transactions. Its most unusual capability allows operators to siphon either part or all of a victim’s cryptocurrency balance rather than simply emptying a wallet in a single operation.

Security researchers uncovered the malware while examining an infection in which a Mac user followed a link delivered by email. The webpage displayed a ClickFix-style prompt that persuaded the victim to copy a command and paste it into the macOS Terminal application.

Executing the command downloaded a Bash script that profiled the machine, collecting hardware and account information before identifying whether the computer used an ARM64 processor or another 64-bit architecture. The loader then downloaded a corresponding version of the malicious Mach-O executable.

The technique reflects a wider shift towards attacks that persuade users to execute commands themselves rather than relying on conventional software installers or exploitable vulnerabilities. ClickFix campaigns typically present fake verification messages, troubleshooting instructions or CAPTCHA-like prompts that claim a command is required to solve a problem or prove that the user is human.

Because users voluntarily invoke the command through Terminal, attackers can exploit legitimate system utilities to fetch and execute code. Threat groups targeting macOS have increasingly adopted this approach, distributing information stealers through fake maintenance guides, system optimisation pages and other apparently helpful content.

The newly examined malware creates directories with names resembling legitimate Apple components and copies itself into locations designed to appear ordinary. It also attempts to remove security attributes associated with downloaded files and establishes mechanisms allowing the payload to run again after the initial compromise.

Attackers can additionally display a deceptive macOS dialogue requesting the user’s password. Credentials entered into the prompt can give the malware greater access to protected data and assist further changes to the compromised device.

Once active, the stealer searches the computer for browser password databases, Apple Keychain information, browser cookies and other files containing cached credentials. Such information can enable attackers to compromise online accounts even when passwords themselves are not immediately available, particularly where valid session data remains active.

Cryptocurrency theft represents the malware’s more distinctive feature. Its code contains a function capable of identifying cryptocurrency wallets, checking their balances and substituting attacker-controlled wallet addresses during transactions.

Supported assets include Bitcoin, Litecoin, Dogecoin, Monero, Ethereum and XRP. The malware can calculate percentages of wallet holdings and redirect only part of the available balance, potentially making theft less obvious than an immediate transfer of all funds.

Researchers found hardcoded attacker-controlled addresses in analysed samples, alongside mechanisms allowing alternative addresses to be obtained from command-and-control infrastructure. Publicly visible addresses embedded in the examined version had not recorded transactions at the time of the analysis, leaving the financial scale of the operation unclear.

The malware was obfuscated using Go Garbler, a tool that can make strings inside compiled Go programs more difficult for analysts and automated security products to examine. Using Go also gives malware developers a mature language and toolchain capable of producing standalone binaries for different processor architectures.

Infrastructure associated with the campaign was linked to the Aeza Group network, a bulletproof hosting operation whose services have been connected with cybercrime and ransomware activity. The group and associated entities faced sanctions from the United States and other governments during 2025.

The incident forms part of a broader expansion of macOS-focused credential theft. Separate campaigns this year have used ClickFix instructions to distribute MacSync, Shub Stealer and Atomic macOS Stealer, while some operations have replaced legitimate cryptocurrency applications such as Ledger, Trezor and Exodus software with trojanised versions.

Attackers have also varied the delivery mechanism as platform protections evolve. Some campaigns use Terminal commands, while others have attempted to exploit Script Editor and AppleScript-based workflows to avoid warnings designed to discourage users from pasting unfamiliar commands into Terminal.

The underlying weakness remains primarily social rather than technical. Victims are persuaded to authorise actions that macOS would otherwise treat with greater suspicion, allowing attackers to turn legitimate utilities into components of the infection chain.

The malware, written in the Go programming language and compiled as a native Mach-O executable, can steal browser credentials and cached authentication data while also manipulating cryptocurrency transactions. Its most unusual capability allows operators to siphon either part or all of a victim’s cryptocurrency balance rather than simply emptying a wallet in a single operation.

Security researchers uncovered the malware while examining an infection in which a Mac user followed a link delivered by email. The webpage displayed a ClickFix-style prompt that persuaded the victim to copy a command and paste it into the macOS Terminal application.

Executing the command downloaded a Bash script that profiled the machine, collecting hardware and account information before identifying whether the computer used an ARM64 processor or another 64-bit architecture. The loader then downloaded a corresponding version of the malicious Mach-O executable.

The technique reflects a wider shift towards attacks that persuade users to execute commands themselves rather than relying on conventional software installers or exploitable vulnerabilities. ClickFix campaigns typically present fake verification messages, troubleshooting instructions or CAPTCHA-like prompts that claim a command is required to solve a problem or prove that the user is human.

Because users voluntarily invoke the command through Terminal, attackers can exploit legitimate system utilities to fetch and execute code. Threat groups targeting macOS have increasingly adopted this approach, distributing information stealers through fake maintenance guides, system optimisation pages and other apparently helpful content.

The newly examined malware creates directories with names resembling legitimate Apple components and copies itself into locations designed to appear ordinary. It also attempts to remove security attributes associated with downloaded files and establishes mechanisms allowing the payload to run again after the initial compromise.

Attackers can additionally display a deceptive macOS dialogue requesting the user’s password. Credentials entered into the prompt can give the malware greater access to protected data and assist further changes to the compromised device.

Once active, the stealer searches the computer for browser password databases, Apple Keychain information, browser cookies and other files containing cached credentials. Such information can enable attackers to compromise online accounts even when passwords themselves are not immediately available, particularly where valid session data remains active.

Cryptocurrency theft represents the malware’s more distinctive feature. Its code contains a function capable of identifying cryptocurrency wallets, checking their balances and substituting attacker-controlled wallet addresses during transactions.

Supported assets include Bitcoin, Litecoin, Dogecoin, Monero, Ethereum and XRP. The malware can calculate percentages of wallet holdings and redirect only part of the available balance, potentially making theft less obvious than an immediate transfer of all funds.

Researchers found hardcoded attacker-controlled addresses in analysed samples, alongside mechanisms allowing alternative addresses to be obtained from command-and-control infrastructure. Publicly visible addresses embedded in the examined version had not recorded transactions at the time of the analysis, leaving the financial scale of the operation unclear.

The malware was obfuscated using Go Garbler, a tool that can make strings inside compiled Go programs more difficult for analysts and automated security products to examine. Using Go also gives malware developers a mature language and toolchain capable of producing standalone binaries for different processor architectures.

Infrastructure associated with the campaign was linked to the Aeza Group network, a bulletproof hosting operation whose services have been connected with cybercrime and ransomware activity. The group and associated entities faced sanctions from the United States and other governments during 2025.

The incident forms part of a broader expansion of macOS-focused credential theft. Separate campaigns this year have used ClickFix instructions to distribute MacSync, Shub Stealer and Atomic macOS Stealer, while some operations have replaced legitimate cryptocurrency applications such as Ledger, Trezor and Exodus software with trojanised versions.

Attackers have also varied the delivery mechanism as platform protections evolve. Some campaigns use Terminal commands, while others have attempted to exploit Script Editor and AppleScript-based workflows to avoid warnings designed to discourage users from pasting unfamiliar commands into Terminal.

The underlying weakness remains primarily social rather than technical. Victims are persuaded to authorise actions that macOS would otherwise treat with greater suspicion, allowing attackers to turn legitimate utilities into components of the infection chain.