Web3 Security · 7 min read · August 8, 2026

One Terminal Command Can Drain a Mac Crypto Wallet

Yes — a single command pasted into Terminal can install Mac malware that steals your credentials and drains a cryptocurrency wallet. Security analysts at Huntress found a Go-based stealer delivered through a ClickFix attack that can empty a wallet, or quietly take just one percent of it. Here is how the attack works and how to avoid it in 2026.

How the ClickFix Attack Works

The malware arrives through a ClickFix attack: a website shows what looks like a CAPTCHA or error message and instructs the visitor to paste a command into Terminal to "fix" it. There is no exploit — the attackers simply persuade the victim to install the malware themselves.

Once pasted, a Bash script profiles the Mac and downloads a payload built for either Apple Silicon or Intel hardware. It then deletes its temporary file, clears the Terminal window, and removes the command from shell history — covering its tracks in seconds.

Huntress analysts found the infection during a retrospective threat hunt in June on a Mac compromised roughly three months earlier, and published their findings on August 6. Newer ClickFix campaigns use Script Editor to work around protections Apple added for commands pasted into Terminal; this incident relied on the older Terminal method, but the payload waiting behind it was more ambitious than the usual credential stealer.

What the Malware Does Once It Is Running

1. It harvests your credentials

The payload searches for browser password databases, Apple Keychain data, cookies and other credential files. Other recent Mac stealers target similar information — this one goes further.

2. It fakes a macOS password prompt

The malware can display a native-looking macOS dialog asking for your password, generated with osascript — a legitimate command-line tool that produces familiar interface elements without needing a full app. One captured password unlock everything else.

3. It can drain a crypto wallet — fully or partially

Its most unusual component is a function called DRAIN, which looks for cryptocurrency wallet addresses and checks their balances through the associated blockchains. The code retrieves an attacker-controlled address and attempts to transfer either the entire balance or a percentage selected through a variable named DRAIN_PCT.

Separate routines cover Bitcoin, Litecoin, Dogecoin, Ethereum and XRP, with Monero references also present. Taking only part of a balance makes the loss less obvious than immediately emptying the wallet — effectively a percentage slider for theft.

Huntress found no evidence the draining function was successfully used: the public wallet addresses embedded in the sample had no recorded transactions or received funds.

How It Disguises Itself as Apple Software

The loader placed one payload version at $HOME/Library/Caches/com.apple.trustd/com.apple.verified, using names that resemble legitimate macOS components, then marked it executable and removed the quarantine attribute. It also established persistence through an executable disguised as Software Update and a LaunchAgent named com.apple.softwareupdated.plist, so the malware ran automatically and appeared in Background Task Management as a normal background item.

Huntress traced the loader, payload hosting and command-and-control infrastructure to IPs controlled by Aeza Group — a bulletproof hosting provider sanctioned by the United States in July 2025 and by the United Kingdom in November 2025 for supporting ransomware and infostealer operations.

The 2026 Protection Checklist

Never paste commands from a website. A legitimate CAPTCHA will never ask you to open Terminal, Script Editor, or any system utility and run a copied command.
Keep macOS current. macOS 27's paste warning and known-malware script blocking reduce risk — do not override the warnings without a reason.
Treat password prompts with suspicion. If a dialog asks for your Mac password outside a known app update flow, cancel it and check running processes.
Keep crypto keys off general-purpose machines. Hardware wallets for anything that can move funds; never store seeds on machines that browse the web.
Watch Background Task Management. Familiarize yourself with your normal background items — unexpected "Software Update" or com.apple entries are a red flag.
Monitor your wallet addresses. Small, partial drains are designed to be missed — check balances and transaction history regularly.

The attack needs no vulnerability. One human decision — pasting one command — is the entire exploit chain.

You Already Pasted the Command — Now What?

Disconnect from the network immediately — the malware phones home for instructions.
Contact an IT administrator or security professional before touching the machine.
Remove the malware binaries — Huntress says deleting them stops the malware from reconstituting itself, though it will not reverse credentials or funds already taken.
Rotate everything: passwords, browser sessions, and API keys stored on the machine.
Move crypto funds out of any wallet that was on the infected Mac, then treat that wallet as burned.

The Bottom Line

Mac wallet-draining malware is no longer hypothetical — the code now exists, and its cleverest trick is stealing less so you do not notice. The defense is boring and effective: never paste commands from the internet, keep macOS updated, and keep your crypto keys off your daily-driver machine.

Your wallet is only as safe as the machine that touches it. Scan your exposed services the way attackers do — before they do.

Frequently Asked Questions

What is a ClickFix attack?

ClickFix is a social-engineering attack that disguises malware instructions as a CAPTCHA or error message. A fake popup tells the victim to paste a command into Terminal (or Script Editor) to "verify" they are human — and the pasted command installs the malware. It needs no vulnerability: the victim runs the malicious command themselves.

Can malware really drain a Mac crypto wallet?

Yes. The DRAIN routine found by Huntress locates cryptocurrency wallet addresses, checks their balances on the associated blockchains, and attempts to transfer either the full balance or a percentage selected by the attacker (a variable named DRAIN_PCT). It covers Bitcoin, Litecoin, Dogecoin, Ethereum and XRP, with Monero references also present.

Does macOS protect against pasted Terminal commands?

macOS 27 adds a security feature that warns users before they paste commands copied from websites, messages or emails, and it can block scripts containing known malware. Users can still override uncertain warnings, so the protection reduces the risk without eliminating it. Newer ClickFix campaigns also use Script Editor to work around the Terminal paste protection.

How do I know if my Mac is infected with ClickFix malware?

Look for unexpected password prompts, unfamiliar background items in macOS Background Task Management, and processes disguised as Apple software (for example in $HOME/Library/Caches/com.apple.trustd/ or a fake Software Update LaunchAgent). Huntress found the malware disguising itself as legitimate Apple components to avoid suspicion.

I pasted a suspicious command into Terminal. What should I do?

Disconnect the Mac from the network immediately and contact an IT administrator or security professional. Deleting the remaining malware binaries stops them from re-installing themselves, but it does not reverse any credentials or funds already taken — so rotate passwords, reset sessions, and move crypto funds from any wallet that was on the machine.

See your exposure the way attackers do

RootCrak's autonomous scanner checks your exposed services, misconfigurations, and vulnerabilities around the clock — and gives you a clear security score with fixes.

Get a Free Security Scan