---
id: "CMP-202611-ynrrwc"
page: "https://infrastack.ai/live/CMP-202611-ynrrwc"
kind: "campaign"
aliases: []
title: "Macfinger ClickFix: fake CAPTCHA pages trick Mac users into pasting a Terminal command that installs the DownTheDRAIN crypto-wallet and data stealer (SANS ISC)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "macOS", "fixed": [], "vendor": "Apple"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-13T04:19:19+00:00"
updated_at: "2026-11-13T04:21:19+00:00"
sources: [{"source": "analyst", "url": "https://isc.sans.edu/diary/Macfinger+ClickFix+campaign+sends+DownTheDRAIN+infostealer+for+macOS", "first_seen_at": "2026-11-13T04:19:19+00:00", "cites": ["https://isc.sans.edu/diary/Macfinger+ClickFix+campaign+sends+DownTheDRAIN+infostealer+for+macOS"]}]
exploit_sources: []
---

# Macfinger ClickFix: fake CAPTCHA pages trick Mac users into pasting a Terminal command that installs the DownTheDRAIN crypto-wallet and data stealer (SANS ISC)

Link for people: https://infrastack.ai/live/CMP-202611-ynrrwc (this .md is for agents)

The Macfinger campaign shows fake CAPTCHA pages that tell Mac users to paste a command into Terminal (ClickFix). The command downloads a bash script that installs a macOS infostealer, which SANS ISC (Brad Duncan) named DownTheDRAIN on 2026-11-13. Huntress analysis of a sample found a DRAIN function that finds crypto wallet addresses and can redirect their contents to the attacker's wallet. ISC has tracked the campaign since 2026-09-22; the infection analysed is from 2026-11-11. On macOS 26.7.3, built-in protection blocked the binary and moved it to Trash before anything was sent out. Victims and how the pages are spread: unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :macOS affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: a person was tricked (social-engineering). The fake CAPTCHA pages tell Mac users to paste a command into Terminal (ClickFix), which downloads and installs the DownTheDRAIN stealer, though the record says how the victims and pages are spread is unknown.

How it reached others: their users installed or auto-updated it (tampered-install).

So it does not happen to you: Use phishing-resistant second factors on the accounts that matter, and never reset a factor on a phone call alone.

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#tampered-install

## How to check

Fake CAPTCHA domain quill-kraee-um2gf[.]pro. Traffic to 45.150.32[.]130 (paths /37339606cba4522a?force=1 and /4be1066a49e75?force=1) and HTTP POST to 171.22.131[.]24:8133/api/t. A file at $HOME/Library/Caches/com.apple.update. SHA-256: 58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db (installer script), 8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd and c34cc30cb1cff5c47d77e62a3ba63e9a183989ec1ccdf7929beb1bcae0d41f23 (Mach-O arm64 stealer). Any 'verify you are human' page that asks you to paste a command into Terminal is this kind of attack.

## Fix

Never paste commands from a web page into Terminal. Block the domain and IPs above. Keep macOS up to date so XProtect stays current. On a Mac that ran the command: isolate it, remove ~/Library/Caches/com.apple.update, then from a clean device change saved browser passwords, sign out sessions, and move crypto funds to a new wallet.

## Timeline

- 2026-11-13T04:19:19+00:00 analyst https://isc.sans.edu/diary/Macfinger+ClickFix+campaign+sends+DownTheDRAIN+infostealer+for+macOS

## Documents

- [describes] @sans_isc: ISC diary: #Macfinger #ClickFix campaign sends #DownTheDRAIN #infostealer for #m https://x.com/sans_isc/status/2121087248758378570
- [describes] Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS (SANS ISC, Brad Duncan) https://isc.sans.edu/diary/Macfinger+ClickFix+campaign+sends+DownTheDRAIN+infostealer+for+macOS

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_