ClickFix macOS Infostealer (Go-based Crypto/Credential Theft Campaign)
First seen Aug 7, 2026 · Updated Aug 7, 2026
A ClickFix-style social engineering campaign is distributing a Go-based infostealer targeting macOS users, designed to exfiltrate cryptocurrency wallets, browser-saved passwords, Apple Keychain contents, and cached credentials. The attack relies on tricking victims into manually executing malicious commands via fake verification or error prompts, bypassing typical download-based security controls.
Technical Analysis
The malware is written in Go, a common choice for cross-platform malware development due to easy compilation and static linking that evades some AV heuristics. Delivery follows the ClickFix technique: victims are lured via fake CAPTCHA, browser update, or error-resolution pages into copying and pasting a malicious shell command into Terminal, which then downloads and executes the payload. Once running, the stealer harvests macOS Keychain data, browser-stored passwords and cookies, and cryptocurrency wallet files/extensions, exfiltrating them to attacker-controlled infrastructure. No specific CVEs are involved since this relies on social engineering rather than a software vulnerability, though it may abuse legitimate macOS APIs (e.g., security command-line tool) to access Keychain data. Organizations running AI agents or LLM-based tools on macOS endpoints face elevated risk, as stolen Keychain credentials and cached browser sessions could include API keys, cloud service tokens, or stored credentials used by agent frameworks and automation pipelines, enabling downstream account takeover or unauthorized API usage.
Affected Systems
macOS endpoints (all recent versions) where users execute ClickFix-style clipboard commands via Terminal; browsers with saved credentials (Chrome, Safari, Firefox); Apple Keychain; cryptocurrency wallet applications and browser extensions (e.g., MetaMask-style wallets)
Indicators of Compromise
- ClickFix lure pages mimicking CAPTCHA/browser verification prompts
- Go-compiled macOS binary payloads (specific hashes not disclosed in source)
- Terminal-based command execution triggered via clipboard paste
- C2 exfiltration endpoints (not disclosed in source article)
Remediation Steps
- 1
User awareness training
Educate users never to copy/paste and execute terminal commands from web prompts, error messages, or CAPTCHA-style verification pages.
- 2
Endpoint monitoring
Deploy EDR on macOS fleets to detect anomalous Terminal/shell command execution, especially processes spawned from browser clipboard actions.
- 3
Credential rotation
Rotate browser-saved passwords, Keychain-stored credentials, and any API keys/tokens that may have been cached on affected machines, particularly those used by AI agent or automation tooling.
- 4
Restrict clipboard-to-terminal execution
Use macOS security policies or MDM configurations to restrict or alert on Terminal.app usage triggered by non-standard workflows.
- 5
Crypto wallet hygiene
Advise users to move cryptocurrency assets to hardware wallets and avoid storing wallet seed phrases or keys in browser-accessible locations.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.