[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSQQLv_P2zPCvsYXJ6jlZnCroPRMSd6JRv062S6DT2NY":3},{"article":4,"iocs":33,"watch_terms":57,"solutions":58,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"597e1c96-d29c-42c9-84e7-95197190c0ea","Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)","macfinger-clickfix-campaign-sends-downthedrain-infostealer-for-macos-fri-nov-13t-9ec741","Introduction","The Macfinger ClickFix campaign is distributing a macOS infostealer dubbed DownTheDRAIN. This malware is designed to identify and redirect cryptocurrency wallet contents to threat actor-controlled wallets. The campaign uses fake CAPTCHA pages to trick users into executing malicious scripts.","Macfinger ClickFix campaign distributes DownTheDRAIN infostealer for macOS.","https:\u002F\u002Fisc.sans.edu\u002Fdiary\u002Frss\u002F33518","https:\u002F\u002Fisc.sans.edu\u002Fdiaryimages\u002Fimages\u002F2026-11-13-ISC-diary-image-01.png","2026-11-13T03:41:41+00:00","2026-11-13T05:00:29.658587+00:00",8,[17],{"name":18,"type":19},"Macfinger ClickFix","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,28],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[34,38,42,44,47,51,54],{"type":35,"value":36,"context":37},"domain","quill-kraee-um2gf.pro","Macfinger domain for the fake CAPTCHA page",{"type":39,"value":40,"context":41},"url","http:\u002F\u002F45.150.32.130\u002F37339606cba4522a?force=1","Infection traffic for DownTheDRAIN infostealer",{"type":39,"value":43,"context":41},"http:\u002F\u002F45.150.32.130\u002F4be1066a49e75?force=1",{"type":39,"value":45,"context":46},"http:\u002F\u002F171.22.131.24:8133\u002Fapi\u002Ft","HTTP POST request from infection traffic",{"type":48,"value":49,"context":50},"hash_sha256","58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db","SHA-256 hash of a shell script that installs DownTheDRAIN infostealer",{"type":48,"value":52,"context":53},"8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd","SHA-256 hash of the DownTheDRAIN infostealer binary",{"type":48,"value":55,"context":56},"c34cc30cb1cff5c47d77e62a3ba63e9a183989ec1ccdf7929beb1bcae0d41f23","SHA-256 hash of the DownTheDRAIN infostealer saved to the infected host",[],{"controls":59,"vendors":144},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":90,"name":91,"problem":92,"products":93},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":119,"name":120,"problem":121,"products":122},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[123,131,138],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":135,"url":136,"description":137},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":140,"url":142,"description":143},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[145],{"slug":124,"name":125,"logo_path":126,"roles":146},[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":158},"fake-captcha-pages-trick-macos-users-into-running-cryptocurrency-stealing-malware","Fake CAPTCHA Pages Trick macOS Users into Running Cryptocurrency-Stealing Malware","The DownTheDRAIN infostealer campaign exploits a simple but effective social engineering technique: convincing users that completing a fake CAPTCHA requires them to manually execute a script in their terminal. Because the malicious action is performed by the user themselves, traditional endpoint defenses may not block it. The malware then silently identifies and redirects cryptocurrency wallet contents to attacker-controlled addresses, resulting in direct and likely irreversible financial loss. This highlights how threat actors increasingly bypass technical controls by targeting human behavior rather than software vulnerabilities.",[153,154,155,156,157],"MITRE ATT&CK T1204.002: User Execution: Malicious File","MITRE ATT&CK T1657: Financial Theft","NIS2 Article 21(2)(g)","CIS Control 14: Security Awareness and Skills Training (v8)","NIST SP 800-53 SI-3: Malicious Code Protection",{"NIS2 Article 21(2)(g)":159,"MITRE ATT&CK T1657: Financial Theft":160,"NIST SP 800-53 SI-3: Malicious Code Protection":161,"MITRE ATT&CK T1204.002: User Execution: Malicious File":162,"CIS Control 14: Security Awareness and Skills Training (v8)":163},"This point requires organizations to implement basic cyber hygiene and security training, which would directly reduce susceptibility to the social engineering lure used in this campaign.","This technique describes adversaries stealing financial assets such as cryptocurrency directly, matching DownTheDRAIN's core objective of redirecting wallet contents to attacker-controlled addresses.","This control requires deploying malicious code protection mechanisms capable of detecting and blocking malware execution, which would help catch the DownTheDRAIN infostealer before it can steal wallet data.","This technique covers attackers relying on users to manually execute malicious content, which is exactly how the fake CAPTCHA page tricks victims into running the DownTheDRAIN payload.","This control requires organizations to train users to recognize and resist social engineering attacks, which is the primary defense against the fake CAPTCHA script-execution trick used here."]