You’ve seen it: an email says your account is locked, your Mac is “out of compliance,” or a tool “needs a quick fix.” One link later, you’re staring at a single Terminal command and thinking, “Fine, I’ll just paste it.” That’s the trap. A new ClickFix-style campaign is doing exactly this on macOS—using a pasted command to pull down a Bash script that profiles your Mac, fetches the right Mach-O payload, and installs a Go-based infostealer that goes after browser passwords, cookies, and Apple Keychain data . The kicker: it also includes crypto-drainer logic that can quietly skim a percentage of a transaction instead of draining the whole wallet .
The “paste this command” moment: why ClickFix works on smart people
The reason this works isn’t that people are careless. It’s that Terminal feels like “the adult fix.” When an email tells you your account is locked or your Mac is “out of compliance,” a single copy/paste command feels like the fastest way back to work.
ClickFix-style attacks lean hard on that instinct. In the Huntress case, the chain starts with a phishing email that sends the victim to a page that instructs them to run a command in macOS Terminal . That’s the whole trick: the attacker doesn’t need to “break in” if they can get you to run the loader yourself.
Why smart people still paste it
These lures hit the same pressure points you deal with every day:
- Urgency: “Fix this now or you lose access.” You don’t want to be the reason a login, payroll, or client deliverable is delayed.
- Authority: The message impersonates IT, security, Apple, or a vendor you already use. It sounds like policy, not a request.
- Simplicity theater: A “quick Terminal fix” looks harmless because it’s short. One line. One Enter. Done.
- Plausible technical framing: Terminal is where real troubleshooting happens, so the request feels normal—especially if you’ve ever copy/pasted commands from a support doc or GitHub issue.
The core flow (what you’re actually agreeing to)
At a high level, ClickFix is a “consent” attack:
- Email lure lands in your inbox and pushes a problem you can’t ignore.
- Link takes you to a page with step-by-step “help.”
- Terminal command downloads and runs a script that kicks off the infection chain.
Once you accept that flow, you’ve handed an attacker what they want most: a trusted execution path that looks like you “chose” it.
That’s why “paste this command” is such a dangerous moment on macOS. It turns Terminal from a tool you control into a delivery mechanism they control.
What the loader does after you hit Enter (in plain English)
Once that command runs, you’re not “fixing” anything. You’re launching a small macOS malware loader whose job is to figure out what kind of Mac it’s on, then fetch the right payload with the least noise.
Step 1: It profiles your Mac (so it downloads the right build)
The first-stage script is a Bash script acting as a profiler and loader. It collects basic system details like CPU and RAM, then uses that to pull down a Mach-O payload that matches your Mac’s processor architecture .
Why this matters: a lot of macOS malware fails when the architecture doesn’t match (Apple silicon vs Intel). This avoids that failure and keeps the infection smooth.
Step 2: It learns who you are (on the Mac)
The profiler also grabs the currently logged-in account name . That sounds minor, but it helps the attacker drop files in places that work for your user context without immediately tripping over permissions.
Step 3: It hides in plain sight with Apple-ish naming
Next comes the “don’t make it look weird” phase:
- It creates a directory named to look like trustd
(trustd is a legitimate macOS process tied to certificate and code-signature validation, so the name blends in.)
- It copies the infostealer/drainer into that directory and names it
com.apple.verified
That filename is doing social engineering after the fact: it nudges you (and sometimes even a rushed IT check) to assume it’s Apple-related.
Step 4: It tries to dull Gatekeeper’s warning signs
macOS tags files downloaded from the internet with a quarantine marker. This loader removes the com.apple.quarantine extended attribute so Gatekeeper is less likely to treat it like a freshly downloaded file and throw a loud warning when it runs .
That’s the pattern to remember: profile → place → disguise → reduce prompts. After that, the real theft logic has room to operate.
The real damage: passwords, cookies, Keychain—and a fake admin prompt that looks legit
Once the payload is running, the goal shifts from “get on the Mac” to strip it for anything that unlocks other accounts. That’s why this ClickFix macOS infostealer goes straight after the stuff your browser and macOS quietly keep on your behalf.
What it tries to steal (and why it’s so valuable)
Huntress notes the malware checks storage for credential-bearing files and targets three big buckets: browser password databases, Apple Keychain, and cached credentials in browser cookies .
Here’s what that means in practical terms:
- Browser-stored passwords: If your browser can autofill it, malware wants it. That can turn one infected Mac into logins for email, banking, payroll, customer tools—whatever you’ve saved.
- Session cookies (cached credentials): Cookies can act like a “still logged in” pass. Stealing them can let an attacker slip into accounts without needing the password right away.
- Apple Keychain data: Keychain often holds Wi‑Fi passwords, saved website creds, and other secrets users forget they even stored. If it’s accessible, it’s a goldmine.
This is why “I don’t store passwords in my browser” isn’t a full defense. Cookies and Keychain can still be enough to get hurt.
The part that feels like macOS: the fake admin prompt
The campaign also uses a classic pressure move: a fake error dialog generated via osascript to trick the user into entering their system password. Huntress says this is used to collect system credentials so the malware can establish persistence and increase privileges .
Why osascript is such a problem: it can pop up a dialog that looks like it came from the OS, right when you expect a “permission” moment. People comply because it feels routine.
A simple rule that saves people
If you ran a “Terminal fix” and then macOS suddenly asks for an admin password due to some vague “error,” treat it as hostile until proven otherwise. That exact pattern—fake error → password prompt → persistence—is called out in this incident .
The twist: a crypto drainer that doesn’t need to empty you to win
Stealing saved passwords is bad. Messing with a crypto transaction while you’re trying to send it is nastier, because it can happen inside what looks like normal behavior.
Huntress found this Go-based macOS stealer includes code that modifies cryptocurrency transactions before they are signed . That’s the key detail. If malware can tamper with what your wallet app is about to sign, you can do everything “right” (open your wallet, review the send, click confirm) and still approve the attacker’s version.
Pre-signing tampering (plain English)
A lot of people think crypto theft requires:
- stealing seed phrases, or
- logging into an exchange, or
- draining the whole wallet in one obvious hit
This one doesn’t need that. It can intercept and redirect transactions and even calculate the total value of a transaction to determine how much to divert . So the theft can be folded into your normal “send crypto” flow.
The “percentage siphon” model
Huntress calls out something that should make anyone doing regular transfers pause: the drainer can be configured to redirect only a percentage of the funds .
They also observed functions that determine the value of 1% of a wallet’s contents, depending on the cryptocurrency . Small diversions are harder to spot:
- It might not trigger your “something’s wrong” alarm
- It can look like a fee, a rate change, or a simple misread
- It can keep working longer because victims don’t immediately go into incident mode
What it targets
The observed targets weren’t obscure coins. Huntress lists Bitcoin (BTC), Ethereum (ETH), Monero (XMR), Litecoin (LTC), Dogecoin (DOGE), and Ripple’s XRP .
That’s why this twist matters: if an attacker can quietly shave off a configurable slice, they don’t need a dramatic “empty the wallet” moment to come out ahead.
A tactical checklist: how to not get burned by “quick fixes” again
This attack works because it turns your hands into the installer. So your defense needs to be a default rule you can follow even when you’re tired, rushed, or slightly stressed.
The 10-second decision rule for macOS Terminal commands
If a message (email, Slack, pop-up, “support” page) tells you to paste a command, run this mental check:
- If the command came from an inbox, refuse by default.
Real IT workflows don’t start with “paste this in Terminal” from a random link. That’s the ClickFix pattern.
- If you can’t explain what it does in one sentence, don’t run it.
You should be able to say: “This installs X from Y source and changes Z.”
- If it downloads and executes in one breath, treat it as hostile.
Anything shaped like “download script → run script” is a common malware loader pattern.
What to verify before you hit Enter
Keep it simple. Verify source, purpose, and footprint:
- Source: Is it a real domain you can verify independently (not from the email itself)?
- Purpose: What problem is this fixing, specifically?
- Footprint: What files does it create, what directories does it touch, what permissions does it ask for?
If you’re in a work environment, ask IT for a ticket, a signed script, or a documented internal runbook. If they can’t provide that, pause.
Red flags that match this campaign
These aren’t abstract. They map to the exact stealth moves described by Huntress:
- Quarantine/Gatekeeper tampering: anything that removes the
com.apple.quarantineextended attribute is trying to reduce macOS warnings - Apple-ish names in weird places: directories made to resemble trustd and payload names like
com.apple.verifiedare meant to blend in - A surprise admin-password prompt: a fake “error” dialog created via
osascriptto collect credentials is a known move here
If you see any of the above, stop. Disconnect from the network if you can, and get help before “checking one more thing.”
A containment habit that pays off: split your identity
Even if you do everything right, you’ll still end up on sketchy sites over time: one-off trials, random webinars, niche tools. The safer move is to keep those signups away from your real email and phone number.
This is where Cloaked fits naturally: you can use masked emails and phone numbers for day-to-day signups, so one bad form fill or phishing follow-up doesn’t become a long-term account takeover path. It’s not a magic shield against malware, but it does shrink the blast radius when attackers go hunting for accounts to reuse.
.png)
