ClickFix for macOS: an infostealer quietly skims a slice of your crypto

Specialists at Huntress, a managed detection and response (MDR) firm, have taken apart a new sample of malware aimed at macOS users. Written in Go, the malware steals crypto assets, passwords saved in browsers, Apple Keychain data and cached credentials from cookies.

How the infection happens

The attack is of the ClickFix variety. The victim receives an email with a link to a page that prompts them to run a command in the Terminal app. The command downloads a Bash script that acts as a profiler and loader: it gathers information about the system (processor, amount of RAM) and pulls down a Mach-O payload matching the processor architecture.

The script determines the current user's name and creates a directory named after trustd — the macOS system process responsible for verifying certificates and digital signatures. The malicious payload is copied there under the name com.apple.verified, after which the com.apple.quarantine extended attribute is stripped from the file so that Gatekeeper won't display a warning on launch.

To establish persistence and escalate privileges, the malware coaxes the administrator password out of the user: using the osascript utility, it pops up a fake dialog box with an error message asking them to enter their credentials.

The crypto trick

The sample's main distinguishing feature is how it handles cryptocurrency transactions. The malware is capable of emptying a wallet entirely, but, as Huntress notes, this is the first time researchers have encountered a crypto drainer that can siphon off not the full amount but only a portion of it. The malware modifies the transaction before it is signed, and it knows how to calculate, for example, 1% of a wallet's contents depending on the currency, redirecting a predetermined share of the funds to the attacker.

The reasoning, it seems, is that an unnoticed leak of a smaller sum will go longer without arousing the victim's suspicion than a wallet suddenly emptied out. In the crosshairs are Bitcoin, Litecoin, Dogecoin, Monero, Ethereum and Ripple (XRP).

The Russian trail

According to Huntress, the malware exchanges data with IP addresses in autonomous system AS210644, which the operator ties to the Russian company Aeza Group. This firm and its associates are under U.S. and U.K. sanctions for providing “bulletproof” hosting to groups distributing ransomware.

Source: Bleeping Computer