Overview
- Huntress discovered remnants of the malware during a June retrospective hunt on a Mac that was likely compromised in March 2026 and published its full technical analysis on August 6, 2026.
- The attack began with a ClickFix fake CAPTCHA that tricked a user into pasting a Terminal command, which downloaded a Bash loader and a Go Mach‑O payload built for the machine’s processor.
- The payload harvests Apple Keychain entries, browser password stores and cookies, uses osascript to prompt for a system password, and hides itself by removing quarantine flags and posing as Apple components.
- A DRAIN routine in the code can check wallet balances and transfer either a configured percentage or the full balance for multiple cryptocurrencies, though Huntress found no evidence the sample they analyzed actually sent funds.
- Huntress published IOCs and mitigation steps including treating ClickFix prompts as high risk, not pasting unknown commands, isolating affected Macs, replacing potentially exposed wallet keys, and blocking related domains and IPs.