What Happened
In June 2026, Huntress discovered a Go-based information-stealing malware campaign targeting macOS systems through ClickFix social engineering attacks. The attack starts when users encounter a fake CAPTCHA prompt. This popup instructs victims to copy a command string and paste it into the macOS Terminal application. The command downloads a Bash profiler that collects system details, then fetches a processor-matched Mach-O payload designed to scrape browser password stores, Apple Keychain data, and cached credentials. The malware includes a DRAIN function that checks cryptocurrency wallet balances and redirects funds to attacker-controlled wallets. The infrastructure traces back to the Aeza Group, a sanctioned Russian bulletproof hoster.
Timeline
Initial compromise: User encounters fake CAPTCHA popup
Execution: User copies and pastes command string into Terminal
Stage 1: Bash profiler collects system architecture details
Stage 2: Processor-matched Mach-O payload downloads and executes
Exfiltration: Malware scrapes credentials from browsers and Apple Keychain
Financial impact: DRAIN function identifies and redirects cryptocurrency holdings
The speed of this attack is critical. Once the user executes the Terminal command, the malware progresses automatically. There's no secondary approval step or authentication challenge. The gap between initial compromise and credential exfiltration can be measured in minutes.
Which Controls Failed or Were Missing
Security awareness training failed to prepare users for this specific social engineering tactic. Traditional phishing awareness focuses on email links and attachments, not fake CAPTCHA prompts that instruct users to execute Terminal commands. Your training likely covers "don't click suspicious links" but probably doesn't address "don't paste unknown commands into Terminal."
Application allowlisting was either absent or insufficiently configured. The Terminal application executed unsigned code without triggering a block. If your organization uses macOS endpoints, you should restrict which applications can execute shell scripts and from which sources.
Browser security controls permitted the malicious popup to display and the command string to be copied. The attack succeeded because the browser didn't block the script that generated the fake CAPTCHA interface.
Network filtering failed to prevent the initial payload download and subsequent command-and-control communication. The loader contacted Aeza Group infrastructure without triggering alerts or blocks.
Cryptocurrency wallet controls were missing. Organizations that permit employees to access cryptocurrency wallets from corporate devices had no monitoring for unusual wallet activity or fund transfers.
Endpoint detection and response (EDR) either wasn't deployed or didn't flag the Bash profiler or Mach-O payload as suspicious. The malware executed without triggering behavioral analysis alerts.
What the Relevant Standard Requires
The NIST Cybersecurity Framework calls for continuous security awareness training (PR.AT-1) that addresses current threat tactics. Your program must evolve as attack methods change. Training materials from 2024 won't prepare users for ClickFix attacks that surged 517% in 2025.
CIS Control 14 (Security Awareness and Skills Training) requires organizations to establish and maintain a security awareness program that addresses social engineering threats. Your program must include specific examples of current attack techniques, not generic warnings about "being careful online."
ISO 27001:2022 Control 6.3 (Information Security Awareness, Education and Training) mandates that personnel receive appropriate training on their information security responsibilities. This includes recognizing and reporting suspicious activity. If your users don't know that fake CAPTCHA prompts requesting Terminal commands are malicious, your training program has a gap.
NIST SP 800-53 Control AT-2 (Literacy Training and Awareness) requires organizations to provide role-based security and privacy literacy training before authorizing access to systems. For macOS users, this should include specific guidance on Terminal usage and the risks of executing unknown commands.
CIS Control 7 (Continuous Vulnerability Management) extends to browser security. You need technical controls that prevent malicious scripts from executing, not just user awareness. Browser add-ons like NoScript implement this control by blocking unauthorized scripts.
NIST SP 800-53 Control SI-3 (Malicious Code Protection) requires mechanisms to detect and eradicate malicious code. Your EDR solution should identify unusual Bash profiler activity and unsigned Mach-O payloads attempting to access credential stores.
Lessons and Action Items for Your Team
Update your security awareness training immediately. Add a module specifically on ClickFix attacks. Show users what the fake CAPTCHA popup looks like. Explain why copying commands into Terminal is dangerous. Make it clear that legitimate CAPTCHA challenges never require Terminal access. Schedule this training within the next 30 days.
Deploy NoScript or similar browser add-ons across your macOS fleet. Configure these tools to block scripts by default, requiring users to explicitly allow scripts on trusted sites. Yes, this creates friction. That friction prevents credential theft.
Implement network-level DNS blocking. Tools like Pi-Hole can prevent known-bad domains from resolving. This won't stop zero-day infrastructure, but it blocks connections to known threat actor hosting like Aeza Group. Your network team can deploy this in a week.
Restrict Terminal usage through application allowlisting. Most users don't need Terminal access for their daily work. If you can't block it entirely, configure your EDR to alert when Terminal executes downloaded scripts. Review these alerts daily.
Establish an immediate reporting protocol. Your users need a one-click method to report suspected ClickFix attacks. When someone reports executing a suspicious Terminal command, your incident response process should trigger isolation mode for that endpoint within minutes. Document this in your incident response runbook today.
Monitor cryptocurrency wallet activity if your organization permits wallet access from corporate devices. Configure alerts for any fund transfers. Better yet, prohibit cryptocurrency wallet access from endpoints that store corporate credentials.
Test your EDR's behavioral detection against this specific attack chain. Download the Bash profiler and Mach-O payload indicators from Huntress (in a safe lab environment) and verify your EDR flags them. If it doesn't, tune your detection rules or evaluate alternative solutions.
Review your macOS security baseline. Apple's built-in security features should require user approval before Terminal executes downloaded content. Verify this setting is enforced across your fleet through your mobile device management platform.
The Huntress research shows that ClickFix attacks aren't theoretical. They're active, they're effective, and they're targeting your macOS users right now. Your response shouldn't be to add this to your quarterly training update. It should be to close these control gaps this month.
