Fake CAPTCHA ‘ClickFix’ Tricks Mac Users to Run Malware

Researchers found macOS infostealer malware delivered through a fake CAPTCHA-style pop-up that convinces users to copy and paste a long command into the Terminal. The command downloads and runs a loader that steals browser passwords, Apple Keychain data, and can even drain cryptocurrency wallets to attacker-controlled addresses. Huntress links the hosting and command-and-control infrastructure to Aeza Group, a sanctioned Russian “bulletproof” hosting provider tied to cybercrime.

Key findings

• The malware was delivered via ClickFix social engineering using a fake CAPTCHA-like pop-up.
• Victims were instructed to copy a long command and paste it into macOS Terminal, which downloads and executes the first stage.
• The loader collected system details, then fetched a Mac-native Mach-O payload matched to the victim’s CPU architecture.
• The Go-based stealer scraped browser password stores, Apple Keychain data, and cached credentials.
• A “DRAIN” function checked crypto wallet balances and redirected funds to attacker-controlled wallets.
• Huntress linked hosting/loader/C2 to Aeza Group, described as a sanctioned Russian bulletproof hoster associated with cybercrime.
• Huntress recommended user education, script-blocking browser add-ons (e.g., NoScript), DNS blocking (e.g., Pi-hole), and rapid IT reporting/isolation if a user runs the command.

Who’s being targeted

• Commonly targeted roles: All employees (macOS users), Executives, Finance/Accounting, Developers/Engineering, IT Helpdesk and Desktop Support.
• Affected industries: Cross-industry (organizations with macOS endpoints), Cryptocurrency holders/users.
• Attack channels: website.
• Impersonated: Website verification/CAPTCHA prompt.

Awareness takeaways

• Train employees that no legitimate CAPTCHA or website ‘verification’ should ever require copying commands into Terminal.
• If anyone runs a suspicious command, require immediate reporting and isolate the device quickly to limit damage.
• Reduce exposure to malicious pop-ups by using script-blocking and DNS blocking controls where appropriate.
• Communicate that these scams can lead to password and Keychain theft and even direct cryptocurrency loss.

Red flags to watch for

• A CAPTCHA/website prompt should never require running Terminal commands
• Instructions to copy/paste a “long command string” are a strong sign of a scam
• The action results in downloading and executing software outside approved IT processes