research (SANS ISC diary, Nov 13, 2026; sample from Nov 11) · published here
Hunt: Macfinger ClickFix fake CAPTCHA pushes the 'DownTheDRAIN' macOS infostealer, which can redirect crypto wallet contents
- Lure domain:
quill-kraee-um2gf[.]pro - Payload URLs:
hxxp://45.150.32[.]130/37339606cba4522a?force=1 (bash installer), hxxp://45.150.32[.]130/4be1066a49e75?force=1 (Mach-O) - C2: HTTP POST to
hxxp://171.22.131[.]24:8133/api/t - SHA-256:
58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db (installer), 8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd (downloaded binary), c34cc30cb1cff5c47d77e62a3ba63e9a183989ec1ccdf7929beb1bcae0d41f23 (saved binary) - Behavior: Terminal spawning
curl/bash to a bare IP with ?force=1; an executable named com.apple.update in ~/Library/Caches.
Sources: SANS ISC: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS (Brad Duncan, Nov 13, 2026)