---
title: Hunt: Macfinger ClickFix fake CAPTCHA pushes the 'DownTheDRAIN' macOS infostealer, which can redirect crypto wallet contents | ctxsec
url: https://ctxsec.com/items/hunt-sans-macfinger-clickfix-downthedrain-macos-infostealer-iocs-nov-11
description: "SANS ISC's Brad Duncan named the macOS infostealer from the Macfinger ClickFix campaign 'DownTheDRAIN', after a DRAIN function Huntress described that finds crypto wallet addresses and can redirect funds to the attacker. A fake CAPTCHA page tells the victim to paste a command into Terminal; it fetches a bash installer, which pulls a ~35 MB arm64 Mach-O and saves it as $HOME/Library/Caches/com.apple.update. On his macOS 26.7.3 test machine, macOS blocked it and moved it to the Trash before it exfiltrated anything."
status: "research (SANS ISC diary, Nov 13, 2026; sample from Nov 11)"
published: 2026-11-13
---

> SANS ISC's Brad Duncan named the macOS infostealer from the Macfinger ClickFix campaign 'DownTheDRAIN', after a DRAIN function Huntress described that finds crypto wallet addresses and can redirect funds to the attacker. A fake CAPTCHA page tells the victim to paste a command into Terminal; it fetches a bash installer, which pulls a ~35 MB arm64 Mach-O and saves it as $HOME/Library/Caches/com.apple.update. On his macOS 26.7.3 test machine, macOS blocked it and moved it to the Trash before it exfiltrated anything.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-sans-macfinger-clickfix-downthedrain-macos-infostealer-iocs-nov-11.md)

research (SANS ISC diary, Nov 13, 2026; sample from Nov 11)

2026-11-13 · published here

2026-11-12 11:41 PM ET

### Hunt: Macfinger ClickFix fake CAPTCHA pushes the 'DownTheDRAIN' macOS infostealer, which can redirect crypto wallet contents

- **Lure domain:** `quill-kraee-um2gf[.]pro`
- **Payload URLs:** `hxxp://45.150.32[.]130/37339606cba4522a?force=1` (bash installer), `hxxp://45.150.32[.]130/4be1066a49e75?force=1` (Mach-O)
- **C2:** HTTP POST to `hxxp://171.22.131[.]24:8133/api/t`
- **SHA-256:** `58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db` (installer), `8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd` (downloaded binary), `c34cc30cb1cff5c47d77e62a3ba63e9a183989ec1ccdf7929beb1bcae0d41f23` (saved binary)
- **Behavior:** Terminal spawning `curl`/`bash` to a bare IP with `?force=1`; an executable named `com.apple.update` in `~/Library/Caches`.

Sources: [SANS ISC: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS (Brad Duncan, Nov 13, 2026)](https://isc.sans.edu/diary/33518)