Mac Malware Found Draining Crypto Wallets After Fake CAPTCHA Trick
macOS malware drains crypto wallets via fake CAPTCHA trick.
Huntress researchers have identified a new macOS malware strain that targets cryptocurrency wallets. The malware, distributed through a fake CAPTCHA scam called ClickFix, gradually siphons funds from victims' wallets. The discovery was made during a threat hunt in June 2026, highlighting ongoing sophisticated attacks against Mac users.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Huntress?
Get an email when a new story names Huntress, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe ClickFix campaign exploits users' trust in routine browser interactions by presenting a convincing fake CAPTCHA that tricks victims into executing malicious code themselves, bypassing many traditional defenses. This social engineering technique is particularly dangerous because the user becomes an unwitting accomplice, making technical controls alone insufficient. Cryptocurrency wallets are high-value, often irreversible targets, meaning fund loss is typically permanent once the malware acts. The incident underscores that macOS users remain active targets and cannot rely on the assumption that Macs are inherently safer from sophisticated malware.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.