New Go‑based malware targets Apple Keychain and browser credentials
A new variant of ClickFix attacks is using a Go‑based malware to siphon cryptocurrency assets, passwords, and Keychain data from macOS users.
A new variant of ClickFix attacks is delivering a Go‑based malware to macOS users, targeting cryptocurrency wallets, browser credentials, and Apple iCloud Keychain data.
The malware, built in Go, is designed to siphon local wallet balances and exfiltrate key material from popular crypto wallets.
In addition to crypto theft, the program harvests passwords stored in browsers such as Safari, Chrome, and Firefox, as well as cached credentials that may be used for VPN or SSH connections.
The infection chain begins with a malicious ad or compromised ad network that delivers a shell script to the victim’s machine.
The shell script profiles the host, determining the CPU architecture—either x86_64 or arm64—and then fetches a macOS malware payload that matches that architecture.
Once the payload is downloaded, it runs in the background, collecting data from the Keychain, browser storage, and local crypto wallets, before sending the harvested information to a remote command‑and‑control server.
Researchers noted that the Go‑based malware uses concurrency to speed up the exfiltration process, allowing it to harvest data from multiple sources in parallel.
The attackers appear to be leveraging the widespread use of ClickFix‑style ad networks to reach a large number of macOS users, making the attack vector highly scalable.
Security teams are advised to keep macOS and all browsers up to date, disable unnecessary keychain sharing, and monitor for unusual outbound traffic to unfamiliar domains.
The emergence of this Go‑based malware highlights the need for macOS users to remain vigilant against ad‑network‑driven threats that can compromise both cryptocurrency assets and personal credentials.
A new variant of ClickFix attacks is delivering a Go‑based malware to macOS users, targeting cryptocurrency wallets, browser credentials, and Apple iCloud Keychain data.
The malware, built in Go, is designed to siphon local wallet balances and exfiltrate key material from popular crypto wallets.
In addition to crypto theft, the program harvests passwords stored in browsers such as Safari, Chrome, and Firefox, as well as cached credentials that may be used for VPN or SSH connections.
The infection chain begins with a malicious ad or compromised ad network that delivers a shell script to the victim’s machine.
The shell script profiles the host, determining the CPU architecture—either x86_64 or arm64—and then fetches a macOS malware payload that matches that architecture.
Once the payload is downloaded, it runs in the background, collecting data from the Keychain, browser storage, and local crypto wallets, before sending the harvested information to a remote command‑and‑control server.
Researchers noted that the Go‑based malware uses concurrency to speed up the exfiltration process, allowing it to harvest data from multiple sources in parallel.
The attackers appear to be leveraging the widespread use of ClickFix‑style ad networks to reach a large number of macOS users, making the attack vector highly scalable.
Security teams are advised to keep macOS and all browsers up to date, disable unnecessary keychain sharing, and monitor for unusual outbound traffic to unfamiliar domains.
The emergence of this Go‑based malware highlights the need for macOS users to remain vigilant against ad‑network‑driven threats that can compromise both cryptocurrency assets and personal credentials.