Macfinger ClickFix campaign targets Macs with crypto stealing malware

SANS Internet Storm Centre handler Brad Duncan says the Macfinger ClickFix campaign delivered a macOS infostealer he has nicknamed DownTheDRAIN. He examined an infection from 11 November 2026. The campaign uses a fake CAPTCHA page to persuade visitors to paste instructions into Terminal. Those instructions retrieve a shell script, which installs the malware.

Huntress’s analysis of a sample found a DRAIN function that identifies cryptocurrency wallet addresses and can redirect their contents to a wallet controlled by the attacker.

Duncan says his Mac mini, running macOS 26.7.3, blocked the malware and moved it to the Trash before it could exfiltrate sensitive data. In the observed infection, the malware made four HTTP POST requests to `171.22.131[.]24:8133/api/t` before it was blocked. Duncan also recorded the fake CAPTCHA domain `quill-kraee-um2gf[.]pro` and two download URLs on `45.150.32[.]130`. The retrieved installer was a 5,011-byte shell script; the downloaded infostealer was a 35,143,984-byte ARM64 Mach-O executable. A second 34,957,760-byte ARM64 copy was saved to `$HOME/Library/Caches/com.apple.update` before macOS moved it to the Trash.