[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsnv8zzUj_IY4FQWH2bklA66MgWSDr5VMHZFvTUjUQl0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"02bf15cf-2dc3-4aee-bc3d-ca71c1d91790","fake-captcha-pages-trick-macos-users-into-running-cryptocurrency-stealing-malware","597e1c96-d29c-42c9-84e7-95197190c0ea","Fake CAPTCHA Pages Trick macOS Users into Running Cryptocurrency-Stealing Malware","The DownTheDRAIN infostealer campaign exploits a simple but effective social engineering technique: convincing users that completing a fake CAPTCHA requires them to manually execute a script in their terminal. Because the malicious action is performed by the user themselves, traditional endpoint defenses may not block it. The malware then silently identifies and redirects cryptocurrency wallet contents to attacker-controlled addresses, resulting in direct and likely irreversible financial loss. This highlights how threat actors increasingly bypass technical controls by targeting human behavior rather than software vulnerabilities.","**Immediate actions:**\n- Train all users to recognize ClickFix and fake CAPTCHA lures that instruct them to paste commands into a terminal or run PowerShell\u002Fshell scripts.\n- Deploy endpoint detection and response (EDR) tools capable of flagging suspicious script execution initiated by browser or user interaction on macOS.\n- Audit cryptocurrency wallet software and browser extensions for signs of tampering or unauthorized access.\n\n**Long-term improvements:**\n- Establish a policy prohibiting users from executing scripts or commands sourced from websites, regardless of claimed purpose.\n- Implement application allowlisting on macOS endpoints to restrict execution of unapproved scripts and binaries.\n- Conduct regular phishing and social engineering simulations that include ClickFix-style scenarios to build user resilience.\n\n**Detection measures:**\n- Monitor endpoint telemetry for shell or terminal processes spawned as children of web browsers, which is a strong indicator of ClickFix-style execution.\n- Alert on outbound connections to newly registered or unknown cryptocurrency wallet endpoints from user workstations.\n- Collect and centralize macOS system logs to enable forensic investigation when suspicious activity is detected.",[12,13,14,15,16],"MITRE ATT&CK T1204.002: User Execution: Malicious File","MITRE ATT&CK T1657: Financial Theft","NIS2 Article 21(2)(g)","CIS Control 14: Security Awareness and Skills Training (v8)","NIST SP 800-53 SI-3: Malicious Code Protection",{"NIS2 Article 21(2)(g)":18,"MITRE ATT&CK T1657: Financial Theft":19,"NIST SP 800-53 SI-3: Malicious Code Protection":20,"MITRE ATT&CK T1204.002: User Execution: Malicious File":21,"CIS Control 14: Security Awareness and Skills Training (v8)":22},"This point requires organizations to implement basic cyber hygiene and security training, which would directly reduce susceptibility to the social engineering lure used in this campaign.","This technique describes adversaries stealing financial assets such as cryptocurrency directly, matching DownTheDRAIN's core objective of redirecting wallet contents to attacker-controlled addresses.","This control requires deploying malicious code protection mechanisms capable of detecting and blocking malware execution, which would help catch the DownTheDRAIN infostealer before it can steal wallet data.","This technique covers attackers relying on users to manually execute malicious content, which is exactly how the fake CAPTCHA page tricks victims into running the DownTheDRAIN payload.","This control requires organizations to train users to recognize and resist social engineering attacks, which is the primary defense against the fake CAPTCHA script-execution trick used here.","published","2026-11-13T05:20:22.471983+00:00","2026-11-13T05:20:22.452+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fisc.sans.edu\u002Fdiary\u002Frss\u002F33518","macfinger-clickfix-campaign-sends-downthedrain-infostealer-for-macos-fri-nov-13t-9ec741","Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":54,"name":55,"problem":56},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]