A Go-based malware delivered in ClickFix attacks targeting macOS users is stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials.
The malware can intercept and redirect transactions with various cryptocurrencies. Although it can empty wallets entirely, it can also calculate the total value of a transaction to determine how much to divert to the attacker.
Security researchers at Managed Detection and Response (MDR) services company Huntress discovered the payload after responding to a ClickFix incident.
The targeted user received an email with a link to a page instructing them to run a command in Terminal.
This downloaded a Bash script acting as a profiler and malware loader that collected system information (e.g., CPU, RAM) and retrieved a Mach-O payload that matched the victim system’s processor architecture.
The profiler also identified the account name for the currently logged-in user and created a directory named after trustd, the macOS process responsible for validating cryptographic certificates and code signatures.
It copied the infostealing and crypto-draining payload to the directory as com.apple.verified and removed the com.apple.quarantine extended attribute to prevent Gatekeeper from treating the file as quarantined and showing a security alert when executed.
According to Huntress’ analysis, the malware establishes persistence and increases privileges by collecting system credentials via a fake error created using the osascript utility.
source: Huntress
The stealer payload checks the storage for files containing credentials, identified both by name and their extension.
“Browser password databases, the Apple Keychain, and cached credentials in browser cookies are all targeted,” Huntress says.
However, the Go-based malware also includes code that modifies cryptocurrency transactions before they are signed, and can be configured to redirect to the attacker only a percentage of the funds.
source: Huntress
Huntress says that it is the first time they analyzed a crypto drainer that did not empty victims’ wallets but could remove less than the total amount.
Additionally, the researchers observed separate functions that determined the value of 1% of the wallet’s content, depending on the cryptocurrency type.
Among the targeted cryptocurrency assets are Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple’s XRP.
According to Huntress, the malware communicates to shared IP addresses in Autonomous System (AS) 210644, which is “operated by a Russian corporation known as the Aeza Group.”
The company and individuals affiliated with it have been sanctioned by the US and the UK for providing bulletproof hosting services to ransomware groups.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.