ClickFix Attack Delivers macOS Infostealer That Hijacks Crypto Transactions and Harvests Keychain Credentials
What Happened — Researchers at Huntress uncovered a Go‑based malware payload delivered via a “ClickFix” phishing campaign targeting macOS users. The payload is a multi‑stage infostealer that extracts browser passwords, Apple Keychain entries, and cached credentials, then modifies cryptocurrency transactions to divert a configurable percentage of funds to attacker‑controlled wallets.
Why It Matters for Compliance & Audit Readiness
- The incident exemplifies a failure of access‑control policies and privileged‑execution safeguards that SOC 2 Trust Services Criteria require.
- Continuous evidence of credential‑use monitoring and endpoint hardening is essential to demonstrate due diligence during an audit.
- Security‑awareness training that validates command‑line instructions can reduce the likelihood of users executing malicious scripts.
Who Is Affected — Primarily macOS users in technology, financial services, and any organization where employees handle cryptocurrency or store sensitive credentials locally.
Recommended Actions
- Map the incident to SOC 2 CC6.1 (Logical Access Controls) and CC6.2 (Least‑Privilege) and collect logs showing privileged command execution.
- Deploy endpoint‑detection‑and‑response (EDR) rules that block unknown Bash script downloads and monitor removal of the
com.apple.quarantineattribute. - Refresh security‑awareness training to cover phishing emails that request terminal commands.
Technical Notes – The attack chain begins with a phishing email that directs the victim to run a curl‑downloaded Bash script. The script profiles the system, drops a Mach‑O payload matching the CPU architecture, writes it to a spoofed trustd directory, strips quarantine flags, and uses osascript to generate a fake error that harvests credentials. The stealer then scans for browser password files, Apple Keychain entries, and cached cookies, and finally intercepts cryptocurrency transaction signing to siphon a configurable portion of the value. Communication is routed to IPs in AS 210644, a Russian‑based hosting provider under sanctions. Source: BleepingComputer