ClickFix macOS Malware Targets User Login Credentials

Security researchers have identified a new malware campaign targeting macOS users through a sophisticated ClickFix technique that combines phishing and social engineering to steal cryptocurrency wallet details, browser credentials, and sensitive personal data.

The Odyssey Stealer malware, discovered by X-Labs researchers in August 2025, represents an evolution of earlier ClickFix attacks that previously focused on Windows systems, now expanding to compromise Apple devices through fake CAPTCHA verification pages.

Fake CAPTCHA Pages Deliver Terminal-Based Attacks

The attack begins when users visit the malicious website “tradingviewen[.]com,” which presents what appears to be a legitimate CAPTCHA verification page.

However, this page is specifically designed to detect the user’s operating system and deliver tailored instructions for each platform.

On macOS systems, victims are prompted to open Terminal through Command+Space, copy provided code, and paste it into the terminal application.

When executed, the seemingly innocuous command decodes a Base64-encoded string that downloads and runs a highly obfuscated AppleScript from a remote server at “45.146.130[.]131/d/vipx14350.”

The social engineering aspect is particularly sophisticated, as the fake CAPTCHA requests users to perform actions that feel legitimate – copying and pasting verification code.

Unlike traditional malware that drops binary files onto the system, this approach executes directly through the terminal, making it harder for conventional security tools to detect.

The attack prompts users to enter their system password, claiming it’s necessary for verification, which grants the malware elevated privileges to access sensitive system areas.

Once executed, the Odyssey Stealer AppleScript performs extensive data collection across multiple platforms and applications:

• Cryptocurrency wallets: Targets popular wallet extensions including Electrum, Exodus, Litecoin, and Wasabi across Chromium-based browsers (Chrome, Brave, Edge, Opera).
• Browser data: Harvests cookies, saved login credentials, autofill data, and form history from both Firefox and Chromium-based browsers.
• Personal files: Collects documents from Desktop and Documents folders with extensions including .txt, .pdf, .docx, and .key files.
• System credentials: Extracts Safari cookies, Apple Notes, and macOS Keychain files containing stored passwords and secure notes.
• Wallet storage: Systematically searches local storage and indexedDB directories for comprehensive cryptocurrency theft capabilities.

The malware’s targeting of crypto assets is particularly concerning, as it specifically enumerates user profiles and extracts extension settings from multiple browser platforms to ensure no cryptocurrency-related information escapes collection.

Advanced Evasion and Data Exfiltration Techniques

The malware demonstrates sophisticated evasion capabilities through multiple layers of obfuscation using randomly generated strings that complicate analysis efforts.

After collecting sensitive data, it packages everything into a ZIP archive stored at “/tmp/out.zip” and uploads it to the command-and-control server at “45.146.130[.]131/log” using curl commands.

The IP address hosts an “Odyssey stealer control panel” where attackers can access harvested data from compromised systems.

Following successful data exfiltration, the malware performs thorough cleanup by removing temporary directories and the ZIP archive, eliminating forensic traces that could aid in investigation.

This approach makes post-incident analysis significantly more challenging for security professionals and system administrators.

Forcepoint has implemented protection measures across multiple stages, blocking malicious URLs, identifying the AppleScript files, and categorizing command-and-control servers under security restrictions.

Indicators of Compromise (IOCs)

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!