Audit log

Every state-changing event for ClickFix macOS Go-Based Infostealer Crypto Wallet Drainer (August 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-15 23:08:00Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   DXBZL6E6TceB…L8K5Xj74copysha256 → base58

   verifying row…

   canonical bytes (27624 B) ▸

   {"actor":"system:backfill","investigation_id":"8209129b-5275-4293-8467-0589f57906c8","kind":"publish","page_slug":"clickfix-macos-go-based-infostealer-crypto-wallet-drainer-august-2026","published_at":"2026-08-15T23:08:00.337Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ClickFix macOS Go-Based Infostealer Crypto Wallet Drainer (August 2026)","sections":[{"content":"Huntress MDR security researcher Andrew Brandt published findings on August 6, 2026, documenting a Go-based macOS stealer discovered during a retrospective threat hunt conducted in June 2026. Analysts determined the monitored endpoint had been infected approximately three months prior — placing the initial compromise around March 2026 — and that the infection had remained dormant and undetected for that entire period. The malware is compiled as a Mach-O executable and delivered as an architecture-specific payload (ARM64 or x86_64) depending on the victim's hardware. The discovery represents a significant finding because the infection predated the threat hunt by months, indicating the malware's anti-detection design was effective against contemporaneous defenses. No public attribution to a named threat actor group has been confirmed; the infrastructure link to Aeza Group establishes hosting provenance but does not in itself identify the operators of this specific campaign.","heading":"Threat Overview and Discovery","severity":"critical","sources":[{"credibility":2,"name":"Wallet-depleting macOS malware wants your crypto — Huntress Blog (Andrew Brandt)","type":"research","url":"https://www.huntress.com/blog/mac-crypto-draining-malware"},{"credibility":2,"name":"ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html"},{"credibility":2,"name":"Go-Based macOS Malware Steals Crypto and Secrets — Infosecurity Magazine","type":"news_article","url":"https://www.infosecurity-magazine.com/news/gobased-macos-malware-crypto-and/"}]},{"content":"The malware is delivered via a social engineering technique known as ClickFix, in which threat actors present victims with a fake CAPTCHA verification prompt or system error message — embedded in a webpage or delivered via email link — that instructs the user to open Terminal and paste a supplied command. The technique exploits user trust in routine verification flows rather than any macOS vulnerability; there is no zero-day or remote code execution exploit involved. Once the victim executes the pasted Bash command, a profiler/loader script runs, collects system information, and retrieves an architecture-specific Mach-O payload from attacker infrastructure. The loader then deletes its temporary file, clears the Terminal window, and removes the command from shell history to suppress evidence of the infection. The ClickFix technique has been documented in multiple prior macOS campaigns since at least early 2025, and Microsoft's Security Blog noted on August 5, 2026 — one day before the Huntress publication — that a macOS ClickFix campaign had evolved to include obfuscation improvements. The technique has been used by both cybercriminal and state-sponsored actors across platforms.","heading":"ClickFix Delivery Mechanism","severity":"high","sources":[{"credibility":2,"name":"Wallet-depleting macOS malware wants your crypto — Huntress Blog","type":"research","url":"https://www.huntress.com/blog/mac-crypto-draining-malware"},{"credibility":2,"name":"One pasted Terminal command opens the door to Mac crypto wallet theft — AppleInsider","type":"news_article","url":"https://appleinsider.com/articles/26/08/06/one-pasted-terminal-command-opens-the-door-to-mac-crypto-wallet-theft"},{"credibility":1,"name":"From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide — Microsoft Security Blog","type":"research","url":"https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/"},{"credibility":2,"name":"macOS ClickFix Social Engineering Campaigns — LevelBlue SpiderLabs","type":"research","url":"https://www.levelblue.com/blogs/spiderlabs-blog/macos-clickfix-social-engineering-campaigns"}]},{"content":"The most distinctive capability of this malware is a function Huntress analysts named DRAIN. According to Huntress researcher Andrew Brandt, the function identifies likely wallet addresses tied to various cryptocurrencies, queries the blockchain to determine whether those wallets carry a balance, and if a balance is found, retrieves an attacker-controlled destination address and redirects the transaction. The payload includes dedicated wallet-handling routines for Bitcoin (BTC), Litecoin (LTC), Dogecoin (DOGE), Ethereum (ETH), and XRP. Huntress also identified variables associated with Monero (XMR), though the analyzed ARM64 sample did not include a fully implemented drain routine for Monero specifically, according to the AppleInsider report. A variable named DRAIN_PCT controls what fraction of a wallet's balance is siphoned in each operation. Brandt noted this partial-drain capability — the ability to extract less than the wallet's full balance — was the first time Huntress had observed this design in wallet-draining macOS malware, as it allows operators to avoid immediate victim detection by bleeding funds incrementally. Importantly, analysis of attacker-controlled wallet addresses embedded in the sample showed no recorded incoming transactions at the time of the Huntress report, meaning there is no confirmed on-chain evidence of funds successfully drained from victims in this specific campaign as of the publication date.","heading":"DRAIN Function and Cryptocurrency Targeting","severity":"critical","sources":[{"credibility":2,"name":"Wallet-depleting macOS malware wants your crypto — Huntress Blog","type":"research","url":"https://www.huntress.com/blog/mac-crypto-draining-malware"},{"credibility":2,"name":"One pasted Terminal command opens the door to Mac crypto wallet theft — AppleInsider","type":"news_article","url":"https://appleinsider.com/articles/26/08/06/one-pasted-terminal-command-opens-the-door-to-mac-crypto-wallet-theft"},{"credibility":3,"name":"ClickFix Attack Delivers macOS Infostealer Built for Crypto Theft — AppleMagazine","type":"news_article","url":"https://applemagazine.com/clickfix-attack-macos-infostealer-crypto-theft/"}]},{"content":"Beyond the cryptocurrency drain function, the malware operates as a broad-scope infostealer. Confirmed data exfiltration targets identified by Huntress include: Apple Keychain credentials (which may contain passwords for email, banking, VPN, and other sensitive services stored by macOS), browser-stored password databases, cached browser cookies (which can enable session hijacking independent of passwords), and cached system credentials. The malware uses osascript — Apple's scripting bridge for AppleScript — to generate native-looking macOS system dialogs prompting users for their account password, enabling privilege escalation or credential capture under the guise of a legitimate system prompt. The payload is placed at the path $HOME/Library/Caches/com.apple.trustd/com.apple.verified, a location chosen to mimic a legitimate Apple system directory and avoid casual detection. Persistence is established via a LaunchAgent plist named com.apple.softwareupdated.plist. Huntress noted that persistence is not guaranteed in all infection instances, and that deletion of the binary is sufficient to remediate the infection without risk of spontaneous reconstitution.","heading":"Credential and Data Theft Capabilities","severity":"critical","sources":[{"credibility":2,"name":"Wallet-depleting macOS malware wants your crypto — Huntress Blog","type":"research","url":"https://www.huntress.com/blog/mac-crypto-draining-malware"},{"credibility":2,"name":"One pasted Terminal command opens the door to Mac crypto wallet theft — AppleInsider","type":"news_article","url":"https://appleinsider.com/articles/26/08/06/one-pasted-terminal-command-opens-the-door-to-mac-crypto-wallet-theft"},{"credibility":2,"name":"Go-Based macOS Malware Steals Crypto and Secrets — Infosecurity Magazine","type":"news_article","url":"https://www.infosecurity-magazine.com/news/gobased-macos-malware-crypto-and/"}]},{"content":"Huntress traced the malware's loader URL, payload hosting, and command-and-control servers to IP addresses within autonomous system AS210644, which is operated by Aeza Group. Specific IP addresses documented in Huntress's analysis include 193.29.224.151, 77.221.152.34, and 138.124.118.69. The initial loader command contacted https://profitnow[.]io/ and http://193.29.224.151/92392991a0cca55?force=1. C2 communication operates over port 8133/tcp via HTTP. Aeza Group is a St. Petersburg, Russia-based bulletproof hosting provider that was formally sanctioned by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) on July 1, 2025, under the designation sb0185. Treasury's action designated Aeza Group LLC along with three affiliated entities (Aeza International Ltd., Aeza Logistic LLC, and Cloud Solutions LLC) and four individual executives: Arsenii Aleksandrovich Penzev (CEO, 33% owner), Yurii Meruzhanovich Bozoyan (General Director, 33% owner), Vladimir Vyacheslavovich Gast (Technical Director), and Igor Anatolyevich Knyazev (33% owner). According to the Treasury press release, Aeza Group had provided bulletproof hosting infrastructure to operators of the Meduza and Lumma infostealer families, the BianLian ransomware group, and administrators of the BlackSprut darknet drug marketplace. The UK National Crime Agency joined the designation of Aeza International Ltd. on the same date; Australia imposed additional sanctions on Aeza-related infrastructure in a subsequent November 2025 round targeting ransomware infrastructure providers. The infrastructure attribution to Aeza links this malware campaign to a sanctioned hosting environment associated with organized cybercrime, though it does not identify the specific threat actor who deployed this payload on Aeza's infrastructure.","heading":"C2 Infrastructure and Aeza Group Attribution","severity":"critical","sources":[{"credibility":2,"name":"Wallet-depleting macOS malware wants your crypto — Huntress Blog","type":"research","url":"https://www.huntress.com/blog/mac-crypto-draining-malware"},{"credibility":1,"name":"Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0185"},{"credibility":2,"name":"OFAC Sanctions Aeza Group for Hosting Global Bulletproof Service — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-aeza-group-bulletproof-hosting-crypto-payments-july-2025/"},{"credibility":2,"name":"U.S. Sanctions Russian Bulletproof Hosting Provider for Supporting Cybercriminals Behind Ransomware — The Hacker News","type":"news_article","url":"https://thehackernews.com/2025/07/us-sanctions-russian-bulletproof.html"},{"credibility":2,"name":"US Treasury Sanctions Global Bulletproof Hosting Service Aeza Group For Enabling Cybercriminal Activity — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-global-bulletproof-hosting-service-aeza-group-for-enabling-cybercriminal-activity"},{"credibility":2,"name":"U.S. Sanctions Russia's Aeza Group for aiding crooks with bulletproof hosting — Security Affairs","type":"news_article","url":"https://securityaffairs.com/179565/cyber-crime/u-s-sanctions-russias-aeza-group-for-aiding-crooks-with-bulletproof-hosting.html"}]},{"content":"Huntress published the following indicators of compromise in its August 2026 report. Organizations and individuals should treat all of these as malicious and block or hunt for them accordingly. File hashes (SHA-256): stealer payload (ARM64 Mach-O): f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0; Bash profiler/loader: 5bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52. Network indicators: domain profitnow[.]io; IP addresses 193.29.224.151, 77.221.152.34, and 138.124.118.69 (all within Aeza Group AS210644); C2 port 8133/tcp. File system indicators: payload path $HOME/Library/Caches/com.apple.trustd/com.apple.verified; persistence LaunchAgent com.apple.softwareupdated.plist. The obfuscated path names (mimicking Apple's trustd and software update services) are designed to evade both casual inspection and automated detection rules that whitelist Apple system processes.","heading":"Indicators of Compromise (IOCs)","severity":"high","sources":[{"credibility":2,"name":"Wallet-depleting macOS malware wants your crypto — Huntress Blog","type":"research","url":"https://www.huntress.com/blog/mac-crypto-draining-malware"},{"credibility":2,"name":"ClickFix attack pushes macOS infostealer for crypto theft attacks — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/"},{"credibility":2,"name":"macOS Stealer Uses ClickFix to Drain Crypto Wallets — SOC Prime","type":"research","url":"https://socprime.com/active-threats/macos-infostealer-targets-cryptocurrency-wallets/"}]},{"content":"The ClickFix technique predates this specific campaign and has been documented across Windows and macOS platforms since at least mid-2024. On macOS specifically, multiple distinct ClickFix campaigns using Terminal-paste delivery were observed in 2025 and 2026, targeting users via fake verification pages, fake error messages embedded in phishing emails, and compromised legitimate websites. Netskope, LevelBlue SpiderLabs, and Microsoft Security have all independently documented macOS ClickFix variants. Microsoft's Security Blog published an analysis on August 5, 2026 — the day before the Huntress report — noting that a macOS ClickFix campaign had adopted new obfuscation techniques to avoid detection. The ClickFix family has been used by both financially motivated criminal actors and state-sponsored groups, and the technique's effectiveness stems from its reliance on user action rather than software vulnerabilities, making it resilient against most patch-based defenses. The broader infostealer ecosystem on macOS has expanded significantly in 2024-2026, with families including AMOS (Atomic macOS Stealer), MacSync, and unnamed Go-based stealers all observed in active campaigns.","heading":"Broader ClickFix Campaign Context","severity":"medium","sources":[{"credibility":1,"name":"From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide — Microsoft Security Blog","type":"research","url":"https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/"},{"credibility":2,"name":"macOS ClickFix Campaign: AppleScript Stealers and New Terminal Protections — Netskope","type":"research","url":"https://www.netskope.com/blog/macos-clickfix-campaign-applescript-stealers-new-terminal-protections"},{"credibility":2,"name":"macOS ClickFix Social Engineering Campaigns — LevelBlue SpiderLabs","type":"research","url":"https://www.levelblue.com/blogs/spiderlabs-blog/macos-clickfix-social-engineering-campaigns"},{"credibility":2,"name":"Bad CAPTCHA in the wild tricks Mac users into installing malware through Terminal — AppleInsider","type":"news_article","url":"https://appleinsider.com/articles/26/03/10/bad-captcha-in-the-wild-tricks-mac-users-into-installing-malware-through-terminal"}]},{"content":"As of the August 6, 2026 Huntress publication, the attacker-controlled wallet addresses embedded in the analyzed malware sample showed no recorded incoming transactions on-chain, meaning no confirmed successful crypto drain had been documented for this specific sample at that time. The campaign's known victim count is limited to the single confirmed Huntress MDR endpoint, though the retrospective nature of the discovery — finding infections months after the fact — means the true scope of compromise is unknown. The malware's long dormancy period (three months in the confirmed case) combined with its anti-forensic design (clearing terminal history, using Apple-mimicking file paths) means that other infected systems may remain undetected. The full credential theft impact (Keychain, browser passwords, cookies) is inherently difficult to quantify, as those stolen credentials may have been exploited silently after exfiltration without any on-chain trace.","heading":"Victim Impact and Confirmed Damage","severity":"high","sources":[{"credibility":2,"name":"Wallet-depleting macOS malware wants your crypto — Huntress Blog","type":"research","url":"https://www.huntress.com/blog/mac-crypto-draining-malware"},{"credibility":2,"name":"One pasted Terminal command opens the door to Mac crypto wallet theft — AppleInsider","type":"news_article","url":"https://appleinsider.com/articles/26/08/06/one-pasted-terminal-command-opens-the-door-to-mac-crypto-wallet-theft"}]},{"content":"Huntress and secondary reporting outlets recommend the following defensive measures. For users: never paste commands into Terminal in response to a web page, CAPTCHA prompt, or unsolicited email instruction, regardless of how routine the prompt appears. For organizations: implement DNS-layer blocking for known malicious domains including profitnow[.]io; deploy endpoint detection rules hunting for the documented SHA-256 hashes and the LaunchAgent com.apple.softwareupdated.plist; monitor for outbound connections to port 8133/tcp and to the documented IP ranges in AS210644. For remediation of confirmed infections: delete the payload binary at $HOME/Library/Caches/com.apple.trustd/com.apple.verified and remove the LaunchAgent plist. Huntress confirmed deletion of the binary is sufficient; the malware does not spontaneously reconstitute. Credential rotation is strongly advised for any account whose passwords may have been stored in Keychain or browser password managers on an affected system, as those credentials were likely exfiltrated to attacker infrastructure.","heading":"Mitigation and Detection Guidance","severity":"medium","sources":[{"credibility":2,"name":"Wallet-depleting macOS malware wants your crypto — Huntress Blog","type":"research","url":"https://www.huntress.com/blog/mac-crypto-draining-malware"},{"credibility":2,"name":"Go-Based macOS Malware Steals Crypto and Secrets — Infosecurity Magazine","type":"news_article","url":"https://www.infosecurity-magazine.com/news/gobased-macos-malware-crypto-and/"},{"credibility":2,"name":"macOS Stealer Uses ClickFix to Drain Crypto Wallets — SOC Prime","type":"research","url":"https://socprime.com/active-threats/macos-infostealer-targets-cryptocurrency-wallets/"}]}],"sources_used":[{"credibility":2,"name":"Wallet-depleting macOS malware wants your crypto — Huntress Blog (Andrew Brandt)","type":"research","url":"https://www.huntress.com/blog/mac-crypto-draining-malware"},{"credibility":2,"name":"ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html"},{"credibility":2,"name":"ClickFix attack pushes macOS infostealer for crypto theft attacks — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/"},{"credibility":2,"name":"One pasted Terminal command opens the door to Mac crypto wallet theft — AppleInsider","type":"news_article","url":"https://appleinsider.com/articles/26/08/06/one-pasted-terminal-command-opens-the-door-to-mac-crypto-wallet-theft"},{"credibility":2,"name":"Go-Based macOS Malware Steals Crypto and Secrets — Infosecurity Magazine","type":"news_article","url":"https://www.infosecurity-magazine.com/news/gobased-macos-malware-crypto-and/"},{"credibility":2,"name":"macOS Stealer Uses ClickFix to Drain Crypto Wallets — SOC Prime","type":"research","url":"https://socprime.com/active-threats/macos-infostealer-targets-cryptocurrency-wallets/"},{"credibility":3,"name":"ClickFix Attack Delivers macOS Infostealer Built for Crypto Theft — AppleMagazine","type":"news_article","url":"https://applemagazine.com/clickfix-attack-macos-infostealer-crypto-theft/"},{"credibility":3,"name":"Mac Malware Found Draining Crypto Wallets After Fake CAPTCHA Trick — IT Security Guru","type":"news_article","url":"https://www.itsecurityguru.org/2026/08/06/mac-malware-found-draining-crypto-wallets-after-fake-captcha-trick/"},{"credibility":2,"name":"Fake CAPTCHA, Real Theft: macOS ClickFix Drains Crypto Wallets — HivePro","type":"research","url":"https://www.hivepro.com/threat-advisory/fake-captcha-real-theft-macos-clickfix-drains-crypto-wallets"},{"credibility":1,"name":"Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0185"},{"credibility":2,"name":"OFAC Sanctions Aeza Group for Hosting Global Bulletproof Service — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-aeza-group-bulletproof-hosting-crypto-payments-july-2025/"},{"credibility":2,"name":"U.S. Sanctions Russian Bulletproof Hosting Provider for Supporting Cybercriminals Behind Ransomware — The Hacker News","type":"news_article","url":"https://thehackernews.com/2025/07/us-sanctions-russian-bulletproof.html"},{"credibility":2,"name":"OFAC Sanctions four Russian-affiliated bulletproof hosting entities — Elliptic","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-four-russian-affiliated-bulletproof-hosting-bph-entities"},{"credibility":2,"name":"US Treasury Sanctions Global Bulletproof Hosting Service Aeza Group For Enabling Cybercriminal Activity — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/treasury-sanctions-global-bulletproof-hosting-service-aeza-group-for-enabling-cybercriminal-activity"},{"credibility":2,"name":"U.S. Sanctions Russia's Aeza Group for aiding crooks with bulletproof hosting — Security Affairs","type":"news_article","url":"https://securityaffairs.com/179565/cyber-crime/u-s-sanctions-russias-aeza-group-for-aiding-crooks-with-bulletproof-hosting.html"},{"credibility":2,"name":"US sanctions yet another Russian bulletproof hosting outfit — The Register","type":"news_article","url":"https://www.theregister.com/2025/07/02/aeza_group_us_sanctions/"},{"credibility":1,"name":"From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide — Microsoft Security Blog","type":"research","url":"https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/"},{"credibility":2,"name":"macOS ClickFix Campaign: AppleScript Stealers and New Terminal Protections — Netskope","type":"research","url":"https://www.netskope.com/blog/macos-clickfix-campaign-applescript-stealers-new-terminal-protections"},{"credibility":2,"name":"macOS ClickFix Social Engineering Campaigns — LevelBlue SpiderLabs","type":"research","url":"https://www.levelblue.com/blogs/spiderlabs-blog/macos-clickfix-social-engineering-campaigns"},{"credibility":2,"name":"Bad CAPTCHA in the wild tricks Mac users into installing malware through Terminal — AppleInsider","type":"news_article","url":"https://appleinsider.com/articles/26/03/10/bad-captcha-in-the-wild-tricks-mac-users-into-installing-malware-through-terminal"},{"credibility":1,"name":"Think before you Click(Fix): Analyzing the ClickFix social engineering technique — Microsoft Security Blog","type":"research","url":"https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/"}],"summary":"A Go-based macOS infostealer delivered via ClickFix fake-CAPTCHA social engineering was confirmed active in August 2026 after Huntress MDR analysts discovered it during a retrospective threat hunt covering an infection that occurred approximately three months earlier. The malware contains a dedicated DRAIN function capable of intercepting cryptocurrency transactions across Bitcoin, Ethereum, Litecoin, Dogecoin, Monero, and XRP, and additionally harvests Apple Keychain credentials, browser passwords, and cached cookies. All command-and-control, loader, and payload hosting infrastructure was traced by Huntress to IP address ranges operated by Aeza Group, a Russian bulletproof hosting provider sanctioned by the U.S. Treasury's OFAC on July 1, 2025.","timeline":[{"date":"2025-07-01","event":"U.S. Treasury OFAC sanctioned Aeza Group LLC and three affiliated entities (Aeza International Ltd., Aeza Logistic LLC, Cloud Solutions LLC) along with four individual executives, for providing bulletproof hosting infrastructure to ransomware and infostealer operators including Meduza, Lumma, and BianLian.","source":"U.S. Department of the Treasury","source_url":"https://home.treasury.gov/news/press-releases/sb0185"},{"date":"2025-11-01","event":"Australia imposed additional sanctions on Aeza-related infrastructure in a round targeting ransomware infrastructure providers; UK had already joined the July 2025 U.S. designation of Aeza International Ltd.","source":"Security Affairs","source_url":"https://securityaffairs.com/179565/cyber-crime/u-s-sanctions-russias-aeza-group-for-aiding-crooks-with-bulletproof-hosting.html"},{"date":"2026-03-01","event":"Approximate date of initial infection: A macOS endpoint monitored by Huntress MDR was compromised via a ClickFix social engineering attack, installing the Go-based infostealer. The infection remained undetected for approximately three months.","source":"Huntress Blog","source_url":"https://www.huntress.com/blog/mac-crypto-draining-malware"},{"date":"2026-03-10","event":"AppleInsider reported on a separate but related macOS ClickFix CAPTCHA campaign using Terminal-paste delivery already active in the wild, documenting the social engineering technique broadly.","source":"AppleInsider","source_url":"https://appleinsider.com/articles/26/03/10/bad-captcha-in-the-wild-tricks-mac-users-into-installing-malware-through-terminal"},{"date":"2026-06-01","event":"Huntress analyst Andrew Brandt discovered components of the Go-based macOS stealer during a retrospective threat hunt on a monitored endpoint, identifying the March 2026 infection approximately three months after the fact.","source":"Huntress Blog","source_url":"https://www.huntress.com/blog/mac-crypto-draining-malware"},{"date":"2026-08-05","event":"Microsoft Security Blog published an analysis documenting that a macOS ClickFix campaign had evolved to include new obfuscation techniques, providing broader context for the threat landscape one day before the Huntress publication.","source":"Microsoft Security Blog","source_url":"https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/"},{"date":"2026-08-06","event":"Huntress published full technical analysis of the Go-based macOS infostealer, documenting the DRAIN function, Aeza Group C2 infrastructure, IOCs, and remediation steps. AppleInsider, The Hacker News, BleepingComputer, IT Security Guru, Infosecurity Magazine, SOC Prime, and AppleMagazine covered the findings the same day.","source":"Huntress Blog","source_url":"https://www.huntress.com/blog/mac-crypto-draining-malware"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 76db4e7b-6888-449c-80e6-07eaf82746efcopy