ClickFix macOS Infostealer Campaign: Detecting and Defeating Go-Based Crypto Theft Malware

---
title: macOS ClickFix Curl Pipe to Shell Execution
id: 3f8c1a92-7b2e-4d51-9f63-2a4b6c8d0e1f
status: experimental
description: Detects curl/wget download-and-pipe-to-shell patterns consistent with ClickFix lures that instruct macOS users to paste commands into Terminal. Parent process is Terminal or iTerm, which strongly indicates manual user-pasted execution.
references:
  - https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1204
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
      - '/Terminal'
      - '/iTerm2'
      - '/zsh'
      - '/bash'
  selection_download:
    CommandLine|contains:
      - 'curl '
      - 'wget '
  selection_pipe:
    CommandLine|contains:
      - '| bash'
      - '| sh'
      - '| zsh'
      - '|bash'
      - '|sh'
      - '|zsh'
  condition: selection_parent and selection_download and selection_pipe
falsepositives:
  - Legitimate developer installation scripts (Homebrew, rustup, oh-my-zsh) — baseline and allowlist by domain
level: high
---
title: macOS Keychain Access via security Utility
id: 9d2e5b14-6c3f-4a78-b521-8e3d7c9a1f02
status: experimental
description: Detects invocation of the macOS security binary to enumerate or dump Keychain contents, a common infostealer behavior for harvesting Apple Keychain data and cached credentials.
references:
  - https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/
  - https://attack.mitre.org/techniques/T1555/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1555.001
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    Image|endswith: '/security'
  selection_cmd:
    CommandLine|contains:
      - 'dump-keychain'
      - 'find-generic-password'
      - 'find-internet-password'
      - 'export'
  filter_keychain:
    CommandLine|contains:
      - 'login.keychain'
      - 'keychain-db'
  condition: selection_img and selection_cmd and not filter_keychain
falsepositives:
  - MDM enrollment and legitimate password management tooling
  - Developer CI scripts retrieving signing certificates
level: high
---
title: macOS Unsigned Binary Execution from Temp Directory
id: 5b7a3c81-2e9d-4f46-a173-6d8c4e2b9f05
status: experimental
description: Detects execution of binaries from macOS temporary or hidden staging directories where ClickFix-delivered Go infostealers commonly write payloads before execution.
references:
  - https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204
  - attack.t1036
logsource:
  category: process_creation
  product: macos
detection:
  selection_path:
    Image|contains:
      - '/private/tmp/'
      - '/var/folders/'
      - '/.tmp/'
      - '/Users/Shared/.'
  selection_parent:
    ParentImage|endswith:
      - '/zsh'
      - '/bash'
      - '/Terminal'
      - '/iTerm2'
  filter_common:
    Image|contains:
      - '/Xcode'
      - '/DerivedData'
  condition: selection_path and selection_parent and not filter_common
falsepositives:
  - Build systems executing from DerivedData or temp build paths — filter by known developer tooling
level: medium

// ClickFix macOS infostealer hunt: download-pipe execution, Keychain access, and credential prompts
let lookback = 14d;
let clickfix_exec = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where DeviceOS has "macOS" or DeviceOS has "Mac"
| where InitiatingProcessFileName in~ ("Terminal", "iTerm2", "zsh", "bash", "sh")
| where ProcessCommandLine has_any ("curl", "wget")
| where ProcessCommandLine matches regex @"\|\s*(bash|sh|zsh)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName, ReportId
| extend DetectionType = "CurlPipeToShell";
let keychain_access = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where DeviceOS has "macOS" or DeviceOS has "Mac"
| where FileName =~ "security"
| where ProcessCommandLine has_any ("dump-keychain", "find-generic-password", "find-internet-password", "login.keychain")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName, ReportId
| extend DetectionType = "KeychainAccess";
let osascript_prompt = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where DeviceOS has "macOS" or DeviceOS has "Mac"
| where FileName =~ "osascript"
| where ProcessCommandLine has_any ("display dialog", "hidden answer", "with password", "System Preferences")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName, ReportId
| extend DetectionType = "OsascriptCredPrompt";
union clickfix_exec, keychain_access, osascript_prompt
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), DetectionTypes=make_set(DetectionType), Commands=make_set(ProcessCommandLine, 10) by DeviceName, AccountName, SHA256
| order by FirstSeen desc

-- ClickFix macOS infostealer triage: suspicious execution paths, persistence, and credential-store access
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)/private/tmp/|/var/folders/|/Users/Shared/\.'
   OR CommandLine =~ '(?i)curl.*\|\s*(bash|sh|zsh)'
   OR CommandLine =~ '(?i)security (dump-keychain|find-generic-password|find-internet-password)'

-- Check LaunchAgents and LaunchDaemons for recently planted persistence
SELECT FullPath, Mtime, Size,
       read_file(filename=FullPath, length=4096) AS PlistContent
FROM glob(globs=['/Library/LaunchAgents/*.plist',
                 '/Library/LaunchDaemons/*.plist',
                 '/Users/*/Library/LaunchAgents/*.plist'])
WHERE Mtime > now() - (14 * 24 * 3600)
ORDER BY Mtime DESC

-- Recent access to browser credential stores and Keychain files
SELECT FullPath, Mtime, Atime, Size
FROM glob(globs=['/Users/*/Library/Application Support/Google/Chrome/*/Login Data',
                 '/Users/*/Library/Application Support/Google/Chrome/*/Cookies',
                 '/Users/*/Library/Keychains/login.keychain-db'])
ORDER BY Atime DESC

#!/bin/bash
# ClickFix macOS infostealer triage and containment script
# Run with sudo on the suspected host. Preserves evidence before remediation.

EVIDENCE_DIR="/var/tmp/clickfix_triage_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$EVIDENCE_DIR"

echo "[+] Collecting suspicious processes (temp paths, curl pipes, security binary)..."
ps aux | grep -Ei '/private/tmp/|/var/folders/|curl.*\| *(bash|sh|zsh)|security (dump-keychain|find-generic-password)' \
  | grep -v grep > "$EVIDENCE_DIR/suspicious_processes.txt"
cat "$EVIDENCE_DIR/suspicious_processes.txt"

echo "[+] Dumping recent shell history for pasted ClickFix commands..."
for user_home in /Users/*; do
  for hist in "$user_home/.zsh_history" "$user_home/.bash_history"; do
    [ -f "$hist" ] && grep -Ei 'curl|wget|osascript|base64' "$hist" >> "$EVIDENCE_DIR/shell_history_hits.txt" 2>/dev/null
  done
done

echo "[+] Listing recently modified LaunchAgents/LaunchDaemons (last 14 days)..."
find /Library/LaunchAgents /Library/LaunchDaemons /Users/*/Library/LaunchAgents \
  -name '*.plist' -mtime -14 -exec ls -la {} \; 2>/dev/null | tee "$EVIDENCE_DIR/persistence.txt"

echo "[+] Checking for unsigned/unsigned-looking binaries in temp staging paths..."
find /private/tmp /var/folders /Users/Shared -type f -perm +111 -mtime -14 2>/dev/null | while read -r f; do
  sig=$(codesign -dv "$f" 2>&1 | head -1)
  echo "$f :: $sig" >> "$EVIDENCE_DIR/unsigned_binaries.txt"
done
cat "$EVIDENCE_DIR/unsigned_binaries.txt" 2>/dev/null

echo "[+] Quarantining suspicious temp-path executables..."
find /private/tmp /Users/Shared -type f -perm +111 -mtime -14 2>/dev/null | while read -r f; do
  if ! codesign -v "$f" 2>/dev/null; then
    mv "$f" "$EVIDENCE_DIR/" && echo "QUARANTINED: $f"
  fi
done

echo "[+] Done. Evidence preserved in $EVIDENCE_DIR"
echo "[!] NEXT STEPS: Force Keychain password change, revoke browser sessions/cookies,"
echo "[!] rotate enterprise SSO credentials, and treat all crypto wallets on this host as compromised."