If you’ve ever copied a command into Terminal because a page told you to “fix” something, you’re exactly who this campaign is built for. ClickFix is the kind of attack that doesn’t need a zero-day or a fancy exploit. It just needs you to run one command. From there, it profiles your Mac, downloads a payload built for your CPU, hides in plain sight, and starts pulling credentials and crypto. Let’s break down the whole chain in plain English, so you know what to look for and what to do if you think you slipped.
How ClickFix Gets You: The “Run This Terminal Command” Trap (and why it works)
ClickFix doesn’t kick the door in. It gets you to open it.
The setup is simple: you get an email that looks like it needs action, you click a link, and the page tells you to run a Terminal command to “fix” the issue. That one move is the whole play. Huntress tracked this exact flow in a real incident response case: an email leads to a page that instructs the target to run a command in Terminal, which then downloads a Bash script .
That’s the “ClickFix macOS terminal command” lure in plain terms. No exploit chain. No pop-up malware installer. Just social engineering plus copy/paste.
Why this works so well on macOS users
Terminal feels official. It’s built-in. It’s what support forums and IT guides tell people to use when “nothing else works.” Attackers know that, and they aim for moments when you’re stressed and moving fast:
- A “security check” that claims your account is blocked
- An “invoice problem” you need to resolve now
- A “delivery exception” you don’t want to miss
Under pressure, a long command looks like a legit diagnostic step, not an attack.
What that one command really does
In the ClickFix cases researchers analyzed, the command pulls down a Bash script that acts as a profiler and malware loader . “Profiler/loader” sounds technical, but the idea is basic:
- Profiler: it checks what kind of Mac you’re on (things like CPU and RAM)
- Loader: it uses that info to fetch the next stage (the actual malware)
That’s why this “run this Terminal command” trap is so effective: the first step is tiny and doesn’t look like “installing a macOS infostealer.” It looks like troubleshooting.
The part people miss: you’re granting trust, not just running text
macOS security features can’t save you from a decision you made on purpose. If you paste a command that downloads and runs a script, you’re giving the attacker what they need: execution. After that, the campaign can move into its real job—profiling your device and staging payloads designed for it .
The Infection Chain, Step by Step: Profiling, Architecture-Matched Payloads, and a Fake trustd Home
Once that script runs, it stops being “a command” and starts being a decision tree. The goal is to figure out what kind of Mac you have, then drop the right payload in the right place with the fewest warnings.
Step 1: The profiler checks your Mac’s specs
The Bash profiler gathers basic system details like CPU and RAM 【】. That sounds harmless, but it’s practical. Attackers don’t want to ship one bloated binary to everyone. They want a clean hit.
What this profiling buys them:
- Better reliability (fewer crashes, fewer obvious failures)
- Faster execution (less time for you to notice something’s off)
- Cleaner targeting (payload matches the machine)
Step 2: It fetches an architecture-matched Mach-O payload
Next, the loader pulls down a Mach-O malware binary that matches the victim’s processor architecture 【】. Translation: Intel Macs and Apple Silicon Macs don’t always get the same file.
This is a big reason ClickFix scales so well. The campaign adapts to your hardware automatically, which keeps the infection chain smooth.
Step 3: It builds a “fake home” that looks like macOS plumbing
Then it starts hiding.
Researchers observed the script creating a directory named after trustd—a real macOS process tied to certificate and code-signature validation 【】. That name choice is not random. It blends into the background noise of macOS.
Inside that trustd-named directory, the malware payload gets copied with a very Apple-sounding filename: com.apple.verified 【】.
If you’re skimming a folder or a process list, those strings look like “normal Mac stuff,” not an infostealer + crypto drainer staging area.
Step 4: It strips quarantine to dodge Gatekeeper friction
macOS uses the com.apple.quarantine extended attribute to flag files that came from the internet. Gatekeeper uses that signal to decide when to throw scary warnings.
In this chain, the attackers remove that quarantine attribute so Gatekeeper is less likely to treat the file as quarantined and pop a security alert when it runs 【】.
Here’s the uncomfortable truth: this isn’t about beating macOS with a fancy exploit. It’s about reducing the number of times your Mac asks, “Are you sure?” and getting you past the last speed bump.
The Credential Grab + The Crypto Drain: What Gets Stolen and How Funds Get Redirected
Once the payload is in place, the mission splits in two: steal access and steal money.
What the macOS infostealer goes after (in human terms)
This ClickFix-delivered malware doesn’t need to “hack” your accounts one by one. It looks for the places your Mac and your browser already keep secrets for convenience.
Huntress’ analysis calls out these targets 【】:
- Browser password databases
Saved logins in your browser can be pulled in bulk. If you’ve ever clicked “Save password,” that’s what this is aimed at.
- Browser cookies (cached sessions)
Cookies can keep you logged in without a password prompt. Stealing them can mean an attacker gets access even if they don’t know your password yet 【】.
- Apple Keychain data
Keychain is where macOS stores passwords, Wi‑Fi secrets, certificates, and more. It’s a high-value target 【】.
- Cached credentials
Anything stored locally “to make sign-in faster” becomes something an infostealer can shop for 【】.
A detail worth paying attention to: the stealer checks storage for credential files based on filenames and extensions, meaning it’s not blindly scraping—it’s hunting specific loot 【】.
How the crypto drainer redirects funds (the nasty part)
The crypto side is where this campaign gets mean.
Huntress notes the malware includes code that can modify cryptocurrency transactions before they are signed 【】. That’s the nightmare scenario: you think you’re sending funds to the right address, but what gets signed isn’t what you intended.
And it doesn’t always go for the obvious “empty the wallet” move. This drainer can be configured to redirect only a percentage of funds 【】—including logic that determines the value of 1% of a wallet’s content, depending on the cryptocurrency type 【】. Quiet theft can stay hidden longer.
Huntress lists targeted assets including:
- Bitcoin (BTC)
- Litecoin (LTC)
- Dogecoin (DOGE)
- Monero (XMR)
- Ethereum (ETH)
- XRP 【】
If you’re wondering why attackers bother with passwords when they can just drain crypto: they want both. Credentials are reusable, sellable, and they open doors long after the initial infection.
Privilege + Persistence: The Fake Password Popup and the Infrastructure Behind It
If the infostealer’s job is to take what’s already accessible, the next move is about expanding what it can touch, and keeping a foothold on your Mac.
The escalation trick: a fake “system” prompt powered by osascript
Huntress observed the malware using osascript to throw a convincing fake error dialog that asks for an admin password .
That detail matters because osascript is a legitimate macOS utility. It can pop UI prompts that look like they came from the system, not a random app. If you’re tired, mid-task, or you already think you’re “fixing” something, this kind of prompt can feel routine.
What the attacker gets if you type your password:
- System credentials (the keys to your Mac, not just a website login)
- A path to increased privileges and persistence, so the malware can survive reboots and reach deeper into the system
Practical read: the campaign starts with you trusting a Terminal command, then follows up with you trusting a “Mac-looking” password box. Same con, different wrapper.
The infrastructure signal: AS210644 and the Aeza Group
Defenders also get something solid to pivot on: Huntress reports the malware communicating with shared IPs in Autonomous System (AS) 210644, “operated by a Russian corporation known as the Aeza Group” .
Aeza Group and affiliated individuals have been sanctioned by the US and the UK for providing bulletproof hosting services used by ransomware groups . That doesn’t tell you exactly who wrote the malware, but it does tell you the kind of hosting environment the campaign is comfortable using.
If you’re hunting this in logs, the value is correlation:
- Unusual outbound connections that tie back to AS210644
- Mac endpoints showing signs of credential prompts that don’t line up with normal admin actions
And if you’re thinking like an attacker: after credentials and crypto, persistence is what turns a “one-time hit” into ongoing access.
Practical Defenses and What To Do If You Think You’re Hit
This campaign wins by reducing friction: you run a command, macOS warnings get minimized, then a legit-looking password prompt shows up. Your defense has to raise friction again—at the right spots.
Practical defenses (what to change before the next email lands)
Treat these as your baseline controls against ClickFix-style “run this Terminal command” attacks.
- Make “paste this into Terminal” a stop sign
- Set a hard rule: no copy/paste commands from email or random web pages.
- If a vendor or internal ticket asks for it, verify via a second channel (Slack/phone/known portal), not the same email thread.
- Control script execution paths
ClickFix starts with a Bash profiler/loader and then drops a payload that’s made to blend in with system-looking names like trustd and com.apple.verified .
- Limit who can run unsigned scripts.
- Watch for unexpected new executables in user-writable locations.
- Monitor for quarantine attribute tampering (Gatekeeper sidestep)
In this chain, the attackers remove the com.apple.quarantine extended attribute to reduce Gatekeeper warnings .
- Alert on suspicious use of
xattrthat removes quarantine flags (especially on newly downloaded binaries).
- Treat “downloaded file with no quarantine attribute” as a signal to investigate, not proof of safety.
- Hunt for trustd lookalikes
The malware creates a directory named after trustd and copies its payload as com.apple.verified .
- Flag weird paths or filenames that mimic Apple components but live in odd places.
- Don’t trust names. Trust provenance and location.
If you think you ran the command: a tight incident response checklist
Speed matters here because the payload targets browser-stored passwords, Apple Keychain data, and cached credentials .
Do this immediately (in order)
- Disconnect the Mac from the internet
Wi‑Fi off. Unplug Ethernet. Stop outbound traffic while you assess.
- Rotate passwords from a clean device
Start with:
- Primary email account(s) (the reset hub)
- Apple ID
- Password manager
- Exchanges / banking logins
The malware targets the places credentials and sessions live , so assume compromise until proven otherwise.
- Revoke active sessions
- Sign out of all sessions in email, Google/Microsoft accounts, social, and any critical SaaS.
- Rotate API keys/tokens if you’re a developer.
- Check crypto wallet activity and approvals
This campaign includes crypto draining behavior; take it seriously even if balances look “fine” today .
- Review recent transactions.
- Review connected apps / approvals in your wallet tools.
- Move remaining funds to a fresh wallet if you have credible signs of compromise.
- Hunt the specific on-box indicators
- Look for a trustd-named directory and a suspicious com.apple.verified file .
- Check whether quarantine attributes were stripped from suspicious files .
- Look for evidence of a fake credential prompt; Huntress observed osascript being used to present a fake error dialog to capture credentials .
Reduce what’s reusable after a credential theft
Even after cleanup, stolen identifiers get reused for follow-on scams and account recovery attempts.
If you sign up for services that don’t need your real info, tools like Cloaked can help by using masked emails and phone numbers. It won’t stop malware, but it can shrink the blast radius when attackers try to recycle what they stole.
.png)
