Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)
Macfinger ClickFix campaign distributes DownTheDRAIN infostealer for macOS.
The Macfinger ClickFix campaign is distributing a macOS infostealer dubbed DownTheDRAIN. This malware is designed to identify and redirect cryptocurrency wallet contents to threat actor-controlled wallets. The campaign uses fake CAPTCHA pages to trick users into executing malicious scripts.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe DownTheDRAIN infostealer campaign exploits a simple but effective social engineering technique: convincing users that completing a fake CAPTCHA requires them to manually execute a script in their terminal. Because the malicious action is performed by the user themselves, traditional endpoint defenses may not block it. The malware then silently identifies and redirects cryptocurrency wallet contents to attacker-controlled addresses, resulting in direct and likely irreversible financial loss. This highlights how threat actors increasingly bypass technical controls by targeting human behavior rather than software vulnerabilities.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — quill-kraee-um2gf.pro
- url — http://45.150.32.130/37339606cba4522a?force=1
- url — http://45.150.32.130/4be1066a49e75?force=1
- url — http://171.22.131.24:8133/api/t
- hash_sha256 — 58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db
- hash_sha256 — 8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd
- hash_sha256 — c34cc30cb1cff5c47d77e62a3ba63e9a183989ec1ccdf7929beb1bcae0d41f23