Researchers have identified a malicious infection chain linked to ClickFix-style attacks, which are being used to deliver a Go-based malware capable of compromising macOS devices. The malware, designed to steal cryptocurrency assets, browser-stored passwords, Apple iCloud Keychain data, and cached credentials, is spread via a sophisticated infection chain that leverages vulnerabilities in the macOS operating system. The attackers are exploiting a chain of vulnerabilities, including a known vulnerability in macOS High Sierra (10.13.6) and a previously undisclosed vulnerability in macOS Mojave (10.14.5). The malware is designed to profile the host system, gather sensitive information, and ultimately deliver a shell script that steals cryptocurrency assets, browser passwords, and other sensitive data. The infection chain is highly complex and requires multiple steps to be executed, making it difficult for users to detect and remove.
According to researchers, the malware is designed to work on macOS versions 10.12.4 to 10.15.7, and it can drain cryptocurrency wallets in under 10 minutes. The attackers are using a combination of social engineering tactics, such as phishing and spear phishing, to trick users into installing the malware. The malware is also designed to evade detection by traditional antivirus software, making it difficult for users to detect and remove.
The malware is written in Go, a programming language commonly used for building scalable and efficient software systems. The malware's creators have used a sophisticated approach to avoid detection, including the use of anti-debugging techniques and code obfuscation. The malware is also designed to be highly persistent, with the ability to survive even if the user logs out or shuts down the system.
The researchers have identified a pattern of suspicious activity, including a suspicious domain registration and a compromised website that is being used to distribute the malware. The attackers are also using a combination of DNS tunneling and HTTP proxying to evade detection and maintain persistence.