Click Fix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
Summary: ClickFix-style attacks are delivering a Go-based macOS stealer that harvests browser passwords, Apple iCloud Keychain data, and cached credentials, and includes a "DRAIN" routine that checks a cryptocurrency wallet for funds and redirects a chunk or all of it to an attacker-controlled wallet. Huntress researcher Andrew Brandt said the malware contains separate functions to determine how much 1% of a wallet's contents is worth for each targeted cryptocurrency, including Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP, and the payload and command-and-control servers link back to infrastructure belonging to Aeza Group, a Russian bulletproof hosting provider sanctioned by the U.S., the U.K., and Australia.
Bottom line: Huntress said this is the first time it has seen malware capable of emptying a cryptocurrency wallet that could remove less than the entire wallet's value, meaning a victim may not notice a partial drain. The staging and C2 infrastructure traces to Aeza Group, a hosting provider already sanctioned by three governments for facilitating bad actors.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026