Go-Based macOS Malware Steals Crypto and Secrets

“The malware also included a DRAIN function that could check whether a cryptocurrency wallet held funds, then redirected all or part of that balance to attacker-controlled wallets.”

The loader, payload hosting and command and control (C2) all link back to the Aeza Group, a sanctioned Russian bulletproof hoster associated with cybercrime.

Huntress advised organizations to mitigate ClickFix threats through user education and by installing malicious script mitigation browser add-ons like NoScript. It added that network devices like Pi-Hole DNS can reduce the chances of popups appearing by blocking known-bad domains from resolving through DNS blocking.

“If a user inadvertently follows through with a ClickFix exploit, it is imperative that the user inform their IT team immediately and that the machine be brought into an isolation mode,” it concluded.

“The malware may or may not achieve persistence, but it is easily remediated by deleting any copies of the binary left behind on the machine. Once deleted, the malware will not spontaneously reconstitute itself.”