{"id":"CMP-202611-ynrrwc","kind":"campaign","aliases":[],"related":[],"title":"Macfinger ClickFix: fake CAPTCHA pages trick Mac users into pasting a Terminal command that installs the DownTheDRAIN crypto-wallet and data stealer (SANS ISC)","description":null,"summary":"The Macfinger campaign shows fake CAPTCHA pages that tell Mac users to paste a command into Terminal (ClickFix). The command downloads a bash script that installs a macOS infostealer, which SANS ISC (Brad Duncan) named DownTheDRAIN on 2026-11-13. Huntress analysis of a sample found a DRAIN function that finds crypto wallet addresses and can redirect their contents to the attacker's wallet. ISC has tracked the campaign since 2026-09-22; the infection analysed is from 2026-11-11. On macOS 26.7.3, built-in protection blocked the binary and moved it to Trash before anything was sent out. Victims and how the pages are spread: unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-13T04:19:19+00:00","products":[{"name":"macOS","fixed":[],"vendor":"Apple"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Fake CAPTCHA domain quill-kraee-um2gf[.]pro. Traffic to 45.150.32[.]130 (paths /37339606cba4522a?force=1 and /4be1066a49e75?force=1) and HTTP POST to 171.22.131[.]24:8133/api/t. A file at $HOME/Library/Caches/com.apple.update. SHA-256: 58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db (installer script), 8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd and c34cc30cb1cff5c47d77e62a3ba63e9a183989ec1ccdf7929beb1bcae0d41f23 (Mach-O arm64 stealer). Any 'verify you are human' page that asks you to paste a command into Terminal is this kind of attack.","fix":"Never paste commands from a web page into Terminal. Block the domain and IPs above. Keep macOS up to date so XProtect stays current. On a Mac that ran the command: isolate it, remove ~/Library/Caches/com.apple.update, then from a clean device change saved browser passwords, sign out sessions, and move crypto funds to a new wallet.","status":"open","published_at":null,"first_seen_at":"2026-11-13T04:19:19+00:00","triaged_at":"2026-11-13T04:19:19+00:00","updated_at":"2026-11-13T04:21:19+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-13T04:24:14Z","path":"tampered-install","entry":"social-engineering","reason":"The fake CAPTCHA pages tell Mac users to paste a command into Terminal (ClickFix), which downloads and installs the DownTheDRAIN stealer, though the record says how the victims and pages are spread is unknown.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-09':105B '-11':72B,113B,114B '-13':73B '-202611':27A '-22':106B '2026':71B,104B,112B '26.7.3':117B 'address':87B 'analys':109B 'analysi':75B 'anyth':131B 'attack':95B 'bash':56B 'binari':124B 'block':122B 'brad':66B 'built':119B 'built-in':118B 'campaign':30B,36B,102B 'captcha':4A,39B 'clickfix':2A,51B 'cmp':26A 'command':13A,48B,53B 'content':92B 'crypto':19A,85B 'crypto-wallet':18A 'data':22A 'download':54B 'downthedrain':17A,69B 'drain':81B 'duncan':67B 'earli':32B 'early-warn':31B 'fake':3A,38B 'find':84B 'found':79B 'function':82B 'huntress':74B 'infect':108B 'infosteal':62B 'instal':15A,59B 'isc':25A,65B,98B 'mac':7A,43B 'macfing':1A,35B 'maco':61B,116B 'macos':29A 'move':126B 'name':68B 'page':5A,40B,139B 'past':10A,46B 'protect':121B 'redirect':90B 'sampl':78B 'san':24A,64B 'script':57B 'sent':133B 'show':37B 'sinc':103B 'spread':141B 'stealer':23A 'tell':42B 'termin':12A,50B 'track':100B 'trash':129B 'trick':6A 'unknown':142B 'user':8A,44B 'victim':135B 'wallet':20A,86B,97B 'warn':33B 'ynrrwc':28A","nicknames":["Macfinger","DownTheDRAIN"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["downthedrain","macfinger","macos"],"ptokens":["macos"],"labels":["campaign","earlywarning","high","other"],"campaign_type":"phishing","search_a":"'-202611':27A 'captcha':4A 'clickfix':2A 'cmp':26A 'command':13A 'crypto':19A 'crypto-wallet':18A 'data':22A 'downthedrain':17A 'fake':3A 'instal':15A 'isc':25A 'mac':7A 'macfing':1A 'macos':29A 'page':5A 'past':10A 'san':24A 'stealer':23A 'termin':12A 'trick':6A 'user':8A 'wallet':20A 'ynrrwc':28A","search_b":"'-09':105B '-11':72B,113B,114B '-13':73B '-22':106B '2026':71B,104B,112B '26.7.3':117B 'address':87B 'analys':109B 'analysi':75B 'anyth':131B 'attack':95B 'bash':56B 'binari':124B 'block':122B 'brad':66B 'built':119B 'built-in':118B 'campaign':30B,36B,102B 'captcha':39B 'clickfix':51B 'command':48B,53B 'content':92B 'crypto':85B 'download':54B 'downthedrain':69B 'drain':81B 'duncan':67B 'earli':32B 'early-warn':31B 'fake':38B 'find':84B 'found':79B 'function':82B 'huntress':74B 'infect':108B 'infosteal':62B 'instal':59B 'isc':65B,98B 'mac':43B 'macfing':35B 'maco':61B,116B 'move':126B 'name':68B 'page':40B,139B 'past':46B 'protect':121B 'redirect':90B 'sampl':78B 'san':64B 'script':57B 'sent':133B 'show':37B 'sinc':103B 'spread':141B 'tell':42B 'termin':50B 'track':100B 'trash':129B 'unknown':142B 'user':44B 'victim':135B 'wallet':86B,97B 'warn':33B","search_c":"","cause_entry":"social-engineering","cause_path":"tampered-install","disclosures_checked_at":null,"first_public_at":"2026-11-13T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-ynrrwc","url":"https://isc.sans.edu/diary/Macfinger+ClickFix+campaign+sends+DownTheDRAIN+infostealer+for+macOS","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T04:19:19+00:00","fetched_at":"2026-11-13T04:19:19+00:00","note":null,"cites":["https://isc.sans.edu/diary/Macfinger+ClickFix+campaign+sends+DownTheDRAIN+infostealer+for+macOS"]}],"documents":[{"id":142472,"url":"https://x.com/sans_isc/status/2121087248758378570","title":"@sans_isc: ISC diary: #Macfinger #ClickFix campaign sends #DownTheDRAIN #infostealer for #m","kind":"post","source":"x","publisher":null,"text":"ISC diary: #Macfinger #ClickFix campaign sends #DownTheDRAIN #infostealer for #macOS https://t.co/NLvGPfIJS1 https://t.co/l69TDzIoDW\n\nlikes 0 reposts 1","published_at":"2026-11-13T03:46:22+00:00","relation":"describes","confidence":null,"note":null},{"id":142634,"url":"https://isc.sans.edu/diary/Macfinger+ClickFix+campaign+sends+DownTheDRAIN+infostealer+for+macOS","title":"Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS (SANS ISC, Brad Duncan)","kind":"blog","source":"analyst","publisher":null,"text":"SANS ISC diary 2026-11-13 by Brad Duncan. Macfinger ClickFix campaign (tracked since 2026-09-22) distributes macOS infostealer nicknamed DownTheDRAIN (Huntress analysis Aug 2026: DRAIN function redirects crypto wallet contents to attacker wallet). Example infection 2026-11-11. Fake CAPTCHA page domain: quill-kraee-um2gf[.]pro. Traffic: hxxp://45.150.32[.]130/37339606cba4522a?force=1 (bash installer script SHA256 58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db), hxxp://45.150.32[.]130/4be1066a49e75?force=1 (Mach-O arm64 SHA256 8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd), POST hxxp://171.22.131[.]24:8133/api/t. Saved to $HOME/Library/Caches/com.apple.update (SHA256 c34cc30cb1cff5c47d77e62a3ba63e9a183989ec1ccdf7929beb1bcae0d41f23). macOS 26.7.3 XProtect blocked it and moved it to Trash.","published_at":"2026-11-13T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}