New Mac Backdoor Masquerades as CAPTCHA, Steals Passwords, Mines Crypto

Key Takeaways

• A new “ClickFix” campaign targets macOS users, disguising a sophisticated backdoor as a CAPTCHA verification process.
• The malware bypasses standard security checks by tricking users into executing a malicious command in Terminal rather than downloading a file.
• Victims face password theft, remote system control, and cryptocurrency mining, with the malware persistently installed on their systems.
• The attacker infrastructure uses EtherHiding via Polygon smart contracts, making command-and-control server tracking difficult.
• Immediate action is required for potentially compromised systems, including network disconnection and professional examination.

New Mac Backdoor Masquerades as CAPTCHA

Mac users are falling victim to an insidious campaign dubbed “ClickFix,” where a seemingly innocuous CAPTCHA verification page initiates a multi-stage attack. This deceptive tactic leads to the installation of a backdoor capable of stealing passwords, enabling remote control, and covertly mining cryptocurrency on compromised systems.

Unlike typical malware that relies on application downloads, this campaign cleverly persuades users to execute a malicious command directly within macOS Terminal. The fake verification page, styled as a “TrustKey human check,” presents an “I’m not a robot” checkbox. Upon selection, the page silently copies a command to the clipboard and then instructs the user to open Spotlight, launch Terminal, paste the “token,” and press Return. This method skillfully sidesteps common security alerts associated with file downloads and evades macOS Gatekeeper checks, making it particularly dangerous.

NetbyteSEC said in a report, which shared insights from an investigation into the macOS lure conducted in July 2026. The report detailed how the pasted command retrieves code from a Cloudflare Worker, executing it via macOS’s AppleScript utility without a noticeable installer. This initial execution lays the groundwork for further compromise.

The ramifications extend beyond a single compromised login. The campaign establishes a persistent agent on the Mac, employs a fake system dialog to harvest the user’s login password, exfiltrates browser and cryptocurrency wallet data, and can deploy XMRig for Monero mining, leveraging the victim’s processing power. This combination of data theft and cryptojacking highlights the significant threat posed by these sophisticated fake CAPTCHA malware loaders.

Fake CAPTCHA Tricks Mac Users

The initial command executed by the victim contacts a Cloudflare Worker, which then delivers an encoded AppleScript payload. This script subsequently writes a LaunchAgent, ensuring the malware’s persistence across user logins. Crucially, the malware queries a Polygon smart contract to dynamically determine the address of its command server. This technique, known as EtherHiding, prevents defenders from blocking a static control domain in the initial sample, complicating detection and mitigation efforts.

The loader requests the current server address from the blockchain and then connects to that address for the next stage of the attack. The ability of the operator to alter the on-chain value allows for rapid changes in infrastructure, making it highly evasive. This approach echoes a previous EtherHiding ClickFix campaign that similarly leveraged blockchain storage to obscure tracking. Following this, the infection deploys a backdoor that identifies the compromised device and user, checks in with the command server, and requests new tasks every minute, maintaining a constant line of communication with the attackers.

One of the most concerning aspects of this attack is its method for credential harvesting. The malware displays a convincing, but counterfeit, macOS System Preferences prompt, persistently demanding the user’s password until a valid one is entered. Once obtained, this cleartext credential is stored locally, ready for exfiltration. This tactic is particularly effective as it leverages user trust in familiar system dialogues.

Users must exercise extreme caution. Any CAPTCHA request that instructs them to open Terminal, “Run,” or utilize any command-line tool should be considered malicious. Authentic verification processes do not require pasting tokens or executing commands via keyboard shortcuts. The safest course of action is to immediately close such pages, as the “ClickFix” lure has demonstrated its versatility in delivering various payloads, including Node.js attacks, underscoring the adaptability of this threat.

Backdoor Steals Data and Mines Crypto

The installed backdoor can retrieve either a full or a lightweight version of the Atomic macOS Stealer (AMOS) module. The comprehensive AMOS module performs an extensive search across browser profiles for saved passwords, cookies, browsing history, cryptocurrency wallet extensions, and encryption keys. Beyond browsers, it also targets the macOS login keychain, Telegram data, Apple Notes, Safari information, and files residing in common personal directories.

The stolen data is then compressed into an archive and uploaded to infrastructure controlled by the attackers. The malware can also extract browser safe-storage keys by repeatedly requesting access to the keychain, effectively pressuring the victim into approving the prompt. This method of credential and wallet theft mirrors the threat posed by macOS crash-reporting stealers, serving as a stark reminder that Mac users are not immune to sophisticated information theft campaigns.

In addition to data exfiltration, a separate task deploys XMRig, a legitimate mining application that is maliciously configured to mine Monero for the attackers. This miner utilizes the Mac’s CPU, leading to sustained high resource usage, increased heat generation, rapid battery drain, and overall degraded system performance. Simply removing the miner is insufficient, as the persistent agent can re-download it. Organizations should actively monitor for Terminal-launched AppleScript activity, unexpected LaunchAgents, Polygon RPC requests, and suspicious password or keychain prompts.

Individuals who suspect they have followed these malicious instructions should immediately disconnect their Mac from all networks, change all passwords from a known clean device, and seek professional assistance for system examination. Thorough removal of the LaunchAgent and the persistent backdoor agent is critical before the system can be safely returned to normal use.

What You Should Do

• Disconnect from Network: If you suspect compromise, immediately disconnect your Mac from the internet and any local networks to prevent further data exfiltration or malware propagation.
• Change Passwords: Change all critical passwords (email, banking, social media, Apple ID) from a trusted, uncompromised device. Do not use the potentially infected Mac for this.
• Seek Professional Help: Have your system professionally examined by a cybersecurity expert. They can identify and thoroughly remove all components of the malware.
• Remove Malicious Components: Ensure the malicious LaunchAgent and backdoor agent are completely removed from your system. Simply deleting the miner is not enough, as it can be reinstalled.
• Be Skeptical of CAPTCHAs: Never follow instructions from a CAPTCHA that asks you to open Terminal, “Run” commands, or paste tokens. Legitimate CAPTCHAs do not require such actions.
• Monitor for Suspicious Activity: Look for unusual CPU usage, unexpected network connections, new LaunchAgents, or repeated password/keychain prompts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.