This sophisticated macOS malware campaign begins with social engineering via a fake CAPTCHA prompt sent through email links, tricking users into running commands in Terminal. The commands download a profiling script that collects system information and deploys architecture-specific Go-based Mach-O payloads. The malware steals browser passwords, Apple Keychain credentials, and cryptocurrency wallets. Its notable feature is a DRAIN function that gradually siphons cryptocurrency from victims’ wallets by redirecting portions to attacker-controlled accounts. Supported cryptocurrencies include Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP. The malware maintains persistence through macOS Background Task Management and uses evasion techniques including Gatekeeper bypass and fake system prompts to harvest credentials. The hosting infrastructure is linked to Aeza Group, a known sanctioned Russian bulletproof hosting provider.

The malware compromises macOS systems by stealing sensitive credentials including browser passwords and Apple Keychain data, as well as cryptocurrency wallet information. It enables attackers to gradually siphon cryptocurrency from victims’ wallets, potentially causing financial losses across multiple cryptocurrency types. The malware’s persistence and evasion techniques increase the difficulty of detection and removal, prolonging exposure and impact.

No official patch or remediation is indicated. Mitigation should focus on user education to avoid executing commands from untrusted sources, especially those prompted by suspicious CAPTCHA-like social engineering. Monitoring for unusual background tasks and suspicious network connections to known malicious infrastructure (e.g., Aeza Group-hosted IPs and domains) may help detect infection. Use of endpoint protection solutions capable of detecting Mach-O payloads and credential-stealing behaviors is recommended. Since no vendor advisory or patch is available, users should remain vigilant and apply best practices for macOS security.