threat-intel
ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
High
Summary
ClickFix-style attacks are being used to deliver a Go-based macOS stealer that can drain cryptocurrency wallets and steal browser-stored passwords and Apple iCloud Keychain data. The malware, developed by the Aeza Group (a Russian bulletproof hosting provider sanctioned by multiple countries), utilizes a 'DRAIN' routine to siphon cryptocurrency funds into attacker-controlled accounts. Recent ClickFix campaigns have also involved using tools like MacSync, Atomic Stealer, and Lumma Stealer, alongside techniques like WebAssembly and SEO poisoning to evade detection.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data