Executive Summary
Huntress recently identified a sophisticated macOS infection chain involving the 'ClickFix' social engineering technique. The attack begins by tricking users into pasting malicious commands into their terminal, which triggers a multi-stage infection process using infrastructure associated with Aeza Group, a sanctioned Russian hosting provider.
The final payload is a Go-based Mach-O malware, sometimes referred to as Malichus, which is architecture-aware (ARM64 vs. x86_64). Beyond standard credential theft from the Apple Keychain and browser databases, the malware features a unique 'DRAIN' function. This function can calculate a specific percentage of a cryptocurrency wallet's value (e.g., 1%) to siphon funds gradually, potentially avoiding immediate detection by the victim.
This campaign highlights the increasing focus of cybercriminal groups on macOS environments and the cryptocurrency sector. Given the use of sanctioned bulletproof hosting and the exploitation of vulnerabilities like CVE-2024-55956 in related implants, organizations should prioritize user education against terminal-based social engineering and monitor for the specific persistence and filesystem artifacts identified in this report.