Affected Systems
macOS systems (all CPU architectures). Users tricked into pasting malicious commands into Terminal. Targets cryptocurrency wallets (Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, XRP), browser passwords, Apple iCloud Keychain, and cached credentials.
Exploitation Status
Active exploitation confirmed. Multiple ClickFix campaigns observed in recent weeks. Infrastructure linked to Aeza Group, a sanctioned Russian bulletproof hosting provider. No CVE assigned (social engineering attack).
Business Impact
High-value targets include users with cryptocurrency holdings and stored credentials. Malware uses privilege escalation via fake system prompts and can drain crypto wallets incrementally (as little as 1% at a time) to evade detection. Parallel Windows ClickFix campaigns abusing pcalua.exe and WebAssembly obfuscation indicate broad, multi-platform threat actor activity. C2 infrastructure uses CDN-fronted, tokenized URLs and browser fingerprinting to evade analysis tools.
Urgency
🟠Within 24 hours
Recommended Actions
- Block Terminal command execution via social engineering: educate macOS users never to paste untrusted commands into Terminal, especially from browser prompts or 'verification' pages.
- Monitor outbound connections to Aeza Group IP ranges and known C2 domains; correlate with EDR telemetry for Bash script execution followed by Mach-O binary downloads.
- Deploy EDR rules to detect suspicious privilege escalation prompts (fake system error dialogs requesting credentials) and flag Go-based binaries with Keychain or wallet access patterns.
- Audit cryptocurrency wallet activity for unexpected small-value transfers (1% increments) that may indicate slow-drain attacks.
- Implement browser and endpoint controls to block WebDAV mounts over HTTPS and rundll32.exe execution from remote shares on Windows endpoints (related ClickFix variant).