Go-Based macOS Malware: A New Threat Emerges
Security researchers at Huntress have uncovered a new strain of infostealing malware designed specifically for macOS. This Go-based macOS malware operates through ClickFix social engineering attacks, a technique that tricks users into executing malicious commands disguised as CAPTCHA prompts.
First identified in June 2026, this malware represents a significant escalation in the sophistication of macOS-targeted threats. Unlike typical malware that requires exploiting system vulnerabilities, this attack relies on human error—a far more unpredictable and effective vector.
How ClickFix Attacks Deliver the Malware
The attack begins with a popup window that appears to be a legitimate CAPTCHA challenge. Users are instructed to copy a long command string and paste it into the Terminal application. This command downloads and executes the initial stage of the attack.
According to Huntress, the command pulls a Bash profiler/loader that collects system details before fetching a Mac-native Mach-O payload matched to the victim’s processor architecture. Mach-O is the executable format used by macOS, and in this case, the Go-based stealer was built to scrape browser password stores, Apple Keychain data, and cached credentials from the infected system.
The Role of Go in the Malware
Go, also known as Golang, has become a popular language for malware development due to its cross-platform capabilities and ease of compiling for different architectures. This particular Go-based macOS malware is a prime example, as it can be tailored to run efficiently on both Intel and Apple Silicon Macs.
Crypto Wallet Drain Function
One of the most concerning features of this malware is its DRAIN function. This capability checks whether a cryptocurrency wallet holds funds and then redirects all or part of that balance to attacker-controlled wallets. This makes the malware particularly dangerous for individuals and organizations that hold digital assets.
“The malware also included a DRAIN function that could check whether a cryptocurrency wallet held funds, then redirected all or part of that balance to attacker-controlled wallets,” the Huntress blog post stated.
Attribution to Aeza Group
The loader, payload hosting, and command and control (C2) infrastructure all link back to the Aeza Group, a sanctioned Russian bulletproof hoster associated with cybercrime. This attribution highlights the ongoing threat from state-aligned or state-tolerant cybercriminal networks.
Bulletproof hosters like Aeza Group provide infrastructure that is resistant to law enforcement takedowns, making them a preferred choice for cybercriminals seeking long-term operational stability.
Mitigation and Response Strategies
Huntress advises organizations to mitigate ClickFix threats through user education and by installing malicious script mitigation browser add-ons like NoScript. Additionally, network devices like Pi-Hole DNS can reduce the chances of popups appearing by blocking known-bad domains from resolving through DNS blocking.
“If a user inadvertently follows through with a ClickFix exploit, it is imperative that the user inform their IT team immediately and that the machine be brought into an isolation mode,” the researchers concluded.
“The malware may or may not achieve persistence, but it is easily remediated by deleting any copies of the binary left behind on the machine. Once deleted, the malware will not spontaneously reconstitute itself.”
Practical Steps for Users
- Always verify the legitimacy of CAPTCHA prompts, especially those that ask you to run commands in Terminal.
- Use browser extensions like NoScript to block unauthorized scripts.
- Implement DNS-level filtering to block known malicious domains.
- Regularly back up important data and maintain offline copies.
- If you suspect a ClickFix attack, disconnect from the network and contact your IT department immediately.
For more on protecting your systems, consider reading about macOS security best practices and ClickFix attack prevention.
