Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)

Reporting by SANS Internet Storm CenterRead the original at isc.sans.edu

Executive Summary

The Macfinger ClickFix campaign distributed a macOS infostealer nicknamed DownTheDRAIN. The malware was observed on Wednesday, November 11, 2026. The activity involved the malware being blocked and moved to Trash by the user's operating system before it could exfiltrate data. Analysis of the sample revealed a DRAIN function designed to identify cryptocurrency wallet addresses and redirect contents to an actor-controlled wallet. Indicators include specific HTTP traffic associated with the infection, including requests to domains like quill-kraee-um2gf[.]pro and specific file hashes for the dropper script and the final malware binary.

Facts Only

* The campaign is named Macfinger ClickFix.
* The malware was nicknamed DownTheDRAIN infostealer.
* The example was distributed on Wednesday, 2026-11-11.
* A macOS system running macOS 26.7.3 blocked and moved the malware to Trash.
* A DRAIN function in the malware identifies cryptocurrency wallet addresses and redirects contents.
* The Macfinger domain used for a fake CAPTCHA page was quill-kraee-um2gf[.]pro.
* Infection traffic included requests to hxxp[:]//45.150.32[.]130/37339606cba4522a?force=1 and hxxp[:]//45.150.32[.]130/4be1066a49e75?force=1.
* Infection files included a shell script installer with SHA-256 hash 58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db.
* The DownTheDRAIN infostealer binary has the SHA-256 hash 8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd.
* The binary was saved to $HOME/Library/Caches/com.apple.update.

Full Take

The narrative frames a specific piece of malware as DownTheDRAIN, linking it directly to the Macfinger ClickFix campaign and highlighting a specific functionality—the DRAIN routine for cryptocurrency theft—as the key threat indicator. The focus on blocking the exfiltration by the operating system introduces a point of friction: user-level security measures successfully thwarted an attack meant to extract sensitive data. This structure highlights the tension between the attacker's objective (data exfiltration) and the defender's capability (system-level mitigation). The provision of specific indicators, including file hashes and network traffic patterns, serves to provide actionable intelligence while embedding the narrative within a campaign context. The process of naming the malware based on analysis from external sources suggests a community-driven method for identifying novel threats when initial attribution is unclear. The implications touch upon how sophisticated threat actor infrastructure must be tracked through specific functions like DRAIN, and how effective endpoint protection can intercept the final payload before it achieves its objective. The potential pattern lies in using specific, named functions to create shorthand that aids in threat intelligence sharing across a community, which can accelerate defense strategies against evolving infostealer techniques.

From the original · SANS Internet Storm Center

Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS Introduction In this diary, I've given a nickname to the macOS infostealer we've been seeing from the Macfinger ClickFix campaign. Based on the analysis of an example posted on the Huntress Cybersecurity Blog, I'm calling this macOS malware DownTheDRAIN infostealer.

Read the full story at isc.sans.edu

Sentinel unavailable

The automated check of the source article's wording did not complete, so no result is shown.

This looks only at the wording of the original source article, not at this page's AI-written sections. A small local AI model made this estimate. It has not been checked against known human and machine texts, so treat it as provisional. It cannot show who wrote an article.