New Mac Malware Steals Crypto, Passwords, and Keychain Data

Introduction

Mac users are facing a new and dangerous threat. Cybercriminals have developed a sophisticated Go-based malware that targets macOS systems to steal cryptocurrency, passwords, and sensitive data stored in Apple's Keychain.

Security researchers at Huntress discovered this malware after responding to a ClickFix attack. The malware is delivered through fake email links that trick users into running malicious commands in their Mac's Terminal.

How the Malware Works

The attack begins with a phishing email. The victim receives an email containing a link to a webpage. This page instructs the user to copy and run a command in their Mac's Terminal application.

Once the command is executed, it downloads a Bash script that acts as a profiler and malware loader. This script:

• Collects system information (CPU, RAM, and more)
• Identifies the logged-in user's account name
• Downloads a malicious payload matching the victim's processor architecture

The malware then disguises itself as a legitimate system process by creating a directory named trustd (which mimics a real macOS process) and copying the malicious payload as com.apple.verified.

To avoid detection, the malware removes the com.apple.quarantine attribute, which prevents Gatekeeper (macOS security feature) from flagging it as a potentially dangerous file.

What the Malware Steals

Once installed, the malware targets a wide range of sensitive data:

• Browser password databases — saved passwords from Chrome, Safari, and other browsers
• Apple Keychain data — stored passwords, credit card details, and secure notes
• Browser cookies — cached credentials that can be used to hijack online sessions
• Cryptocurrency assets — Bitcoin, Ethereum, Monero, and many others

The Clever Crypto-Draining Technique

What makes this malware especially dangerous is its smart crypto-draining capability. Unlike other malware that simply empties wallets entirely, this one can:

• Calculate transaction amounts — it analyzes how much you are trying to send
• Divert a percentage — it can redirect only a portion of the transaction to the attacker's wallet
• Steal 1% or more — the malware can be configured to take as little as 1% of your wallet's value
• Modify transactions before signing — it intercepts and changes crypto transactions before they are confirmed

This makes the attack much harder to detect. Victims may not realize their funds are being stolen because only a small amount is taken each time.

Who Is Behind the Attack?

According to Huntress, the malware communicates with servers in Autonomous System (AS) 210644, which is operated by a Russian corporation known as the Aeza Group.

The Aeza Group and its affiliates have been sanctioned by the US and UK for providing "bulletproof hosting" services to ransomware groups. This means they host websites and servers that are used by cybercriminals without interference.

How to Protect Yourself

Follow these steps to stay safe from this malware:

• Never run commands from emails. Legitimate organizations will never ask you to copy and run Terminal commands via email.
• Be skeptical of links in emails. Even if the email looks official, verify the sender's address carefully.
• Keep your Mac updated. Apple regularly releases security patches that protect against known threats.
• Use strong, unique passwords. Consider using a password manager to store and generate secure passwords.
• Enable two-factor authentication (2FA). This adds an extra layer of security to your online accounts and crypto wallets.
• Use a reputable antivirus for Mac. Macs are not immune to malware. Invest in security software that can detect and block these threats.
• Monitor your crypto transactions. Regularly check your wallet for unusual activity, even small amounts.
• Store crypto in hardware wallets. Cold wallets are not connected to the internet and are much harder to compromise.

Final Thoughts

This new Mac malware is a reminder that cybercriminals are constantly evolving. They are using sophisticated techniques to steal valuable data while avoiding detection.

Mac users should never assume they are immune to malware. This attack shows that even macOS systems are vulnerable to advanced threats.

Key takeaways:

• Never copy and run Terminal commands from emails
• Use hardware wallets for cryptocurrency storage
• Enable 2FA on all important accounts
• Keep your Mac and antivirus software updated
• Monitor your accounts for unusual activity

If you need help securing your devices or want to learn more about protecting your business from malware, contact SystemLogicIT for a free security assessment.