MACOS · CMP-202611-ynrrwc · Other
NO FIX YET · SEE WHAT TO DO
The Macfinger campaign shows fake CAPTCHA pages that tell Mac users to paste a command into Terminal (ClickFix). The command downloads a bash script that installs a macOS infostealer, which SANS ISC (Brad Duncan) named DownTheDRAIN on 2026-11-13. Huntress analysis of a sample found a DRAIN function that finds crypto wallet addresses and can redirect their contents to the attacker's wallet. ISC has tracked the campaign since 2026-09-22; the infection analysed is from 2026-11-11. On macOS 26.7.3, built-in protection blocked the binary and moved it to Trash before anything was sent out. Victims and how the pages are spread: unknown.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
verify you are human page that asks you to paste a command into Terminal is this kind of attackPosts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.