ClickFix macOS Stealer (Go-based Crypto/Credential Stealer)
First seen Aug 8, 2026 · Updated Aug 8, 2026
A ClickFix-style social engineering campaign is delivering a Go-based macOS infostealer capable of draining cryptocurrency wallets, harvesting browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The infection chain uses a shell script that profiles the victim's CPU architecture before fetching an architecture-specific malware payload, indicating deliberate targeting and evasion.
Technical Analysis
The attack begins with a ClickFix-style lure, likely a fake CAPTCHA, error message, or verification prompt that tricks users into copying and executing a malicious shell command manually, bypassing typical download-based defenses. This dropper script performs host reconnaissance including CPU architecture detection (Intel vs Apple Silicon) before retrieving a compatible Go-compiled macOS binary, suggesting cross-platform builds. The payload targets browser credential stores, Apple iCloud Keychain, cached authentication tokens, and cryptocurrency wallet data, giving attackers broad access to stored secrets. Because developers and operators frequently run AI agent frameworks, CLI tools, and RAG pipelines on macOS workstations, credential and keychain theft from this stealer could expose API keys, cloud service tokens, and LLM provider credentials stored locally or in browser session data, enabling downstream compromise of agent-integrated systems. The use of ClickFix social engineering combined with architecture-aware payload delivery indicates a moderately sophisticated, actively evolving campaign.
Affected Systems
macOS systems (both Intel x86_64 and Apple Silicon/ARM64), browsers with stored password managers, Apple iCloud Keychain, local cryptocurrency wallet applications and browser extensions
Indicators of Compromise
- Note: specific hashes, C2 domains, and file names were not disclosed in the source data; monitor The Hacker News and related vendor writeups for updated IOC lists
Remediation Steps
- 1
User awareness training
Educate users to never copy-paste and execute terminal/shell commands from websites, popups, or 'verification' prompts (ClickFix technique).
- 2
Restrict script execution
Use macOS Gatekeeper, notarization enforcement, and endpoint protection to block unsigned/unauthorized shell script execution.
- 3
Credential rotation
Rotate browser-stored passwords, API keys, and cloud/LLM provider tokens on any macOS device suspected of compromise.
- 4
Endpoint monitoring
Deploy EDR on macOS fleets to detect anomalous shell script execution, keychain access attempts, and outbound connections to unknown domains.
- 5
Wallet security
Move cryptocurrency assets to hardware wallets and enable multi-factor authentication on exchange accounts.
- 6
Secrets management review
Audit where AI agent and LLM API keys are stored on developer machines; move to secure vaults instead of browser storage or plaintext files.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.