Macfinger ClickFix campaign delivers DownTheDRAIN crypto-draining infostealer for macOS

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5922 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Macfinger ClickFix - Terminal curl Piped To Shell From Staging Host (DownTheDRAIN)

Detects the ClickFix execution step of the Macfinger campaign (DownTheDRAIN infostealer) on macOS: a pasted Terminal command that uses curl with a '?force=1' URL piped into bash/sh/zsh, a base64-decoded payload piped to a shell, or curl against the known Aeza-hosted staging IPs (45.150.32.130, 45.131.215.56, 45.150.33.128, 193.29.224.151, 77.221.152.34). The downloaded 4.7-5 KB script selects an arm64 or x86_64 Go Mach-O and installs it under a fake com.apple path.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1059.004, T1140
• Data sources: osquery (index=macos sourcetype=osquery:results), macos_endpoint_security
• Severity: high
• Confidence: high

Splunk SPL

index=macos sourcetype="osquery:results"
| eval cmd=lower('columns.cmdline'), usr='columns.username'
| where (like(cmd,"%curl%") AND ((like(cmd,"%force=1%") AND match(cmd,"[|] *(ba|z)?sh( |$|;)")) OR match(cmd,"(45[.]150[.]33[.]128|45[.]131[.]215[.]56|45[.]150[.]32[.]130|193[.]29[.]224[.]151|77[.]221[.]152[.]34)"))) OR (match(cmd,"base64 +(-d|--decode)") AND match(cmd,"[|] *(ba|z)?sh( |$|;)"))
| stats count as events min(_time) as first_seen max(_time) as last_seen values(cmd) as command_lines by host, usr
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - events

Microsoft KQL

let StagingIPs = dynamic(['45.150.33.128','45.131.215.56','45.150.32.130','193.29.224.151','77.221.152.34']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath startswith '/'
| where (ProcessCommandLine has 'curl' and ((ProcessCommandLine contains 'force=1' and ProcessCommandLine matches regex '[|] *(ba|z)?sh( |$|;)') or ProcessCommandLine has_any (StagingIPs))) or (ProcessCommandLine has 'base64' and ProcessCommandLine matches regex '(?i)base64 +(-d|--decode)' and ProcessCommandLine matches regex '[|] *(ba|z)?sh( |$|;)')
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: macOS ClickFix Terminal curl Piped To Shell From Staging Host
id: 7c1e2a90-3b4d-4f6a-8e15-2a9d0c1b5f01
status: experimental
description: Detects Macfinger ClickFix execution on macOS where a pasted Terminal command uses curl with a force=1 URL piped into a shell, a base64 decoded payload piped into a shell, or curl against known staging IPs (TL-2026-5922).
references:
  - https://isc.sans.edu/diary/rss/33518
  - https://www.huntress.com/blog/mac-crypto-draining-malware
author: Threadlinqs Team
date: 2026/11/13
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.004
  - attack.t1140
logsource:
  product: macos
  category: process_creation
detection:
  selection_curl:
    CommandLine|contains|all:
      - 'curl'
      - 'force=1'
  selection_curl_any:
    CommandLine|contains: 'curl'
  selection_shell_pipe:
    CommandLine|contains:
      - '| bash'
      - '|bash'
      - '| sh'
      - '|sh'
      - '| zsh'
      - '|zsh'
  selection_b64:
    CommandLine|contains:
      - 'base64 -d'
      - 'base64 -D'
      - 'base64 --decode'
  selection_staging:
    CommandLine|contains:
      - '45.150.33.128'
      - '45.131.215.56'
      - '45.150.32.130'
      - '193.29.224.151'
      - '77.221.152.34'
  condition: (selection_curl and selection_shell_pipe) or (selection_curl_any and selection_staging) or (selection_b64 and selection_shell_pipe)
falsepositives:
  - Developers installing tools with curl-to-shell one-liners (for example Homebrew or rustup)
  - Administrators running base64-decoded provisioning scripts
level: high

Known false positives:

• Developers installing tools with curl-to-shell one-liners such as Homebrew or rustup
• Administrators running base64-decoded provisioning scripts from Terminal

Tuning notes: Adjust index/sourcetype and the columns.* field names to your osquery pack or EDR feed. Allowlist known package-manager URLs and managed-device script hosts. The exact ClickFix command text was not published, so the generic curl-pipe-shell clause is paired with the force=1 query and the staging IP list; refresh the IP list as the campaign rotates infrastructure.

• 🔒 Macfinger - Mach-O Stealer Executed From Fake com.apple Path In User Caches · unlock with TL Creds
• 🔒 Macfinger - Quarantine Stripping, Shell History Wiping and Process Kill Of Fake Apple Names · unlock with TL Creds
• 🔒 Macfinger - Outbound Connections From Fake com.apple Binary In User Caches · unlock with TL Creds
• 🔒 Macfinger - Fake CAPTCHA Lure Domains and Staging Server Downloads · unlock with TL Creds
• 🔒 Macfinger - osascript Fake Password Prompt and Keychain/Browser Credential Access · unlock with TL Creds
• 🔒 Macfinger - Go-http-client Beaconing To TCP 8133 C2 · unlock with TL Creds
• 🔒 Macfinger - com.apple.softwareupdated LaunchAgent Persistence (DownTheDRAIN) · unlock with TL Creds
• 🔒 Macfinger - DownTheDRAIN HTTP C2 and Credential Exfiltration on TCP 8133 · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-5922.

Sample indicators (3 of 28)

• IP address: 45.150.32[.]130
• Domain: quill-kraee-um2gf[.]pro
• File hash: 58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

Technical analysis

Delivery: Legitimate websites are injected with JavaScript that fingerprints visitors and, for macOS hosts, shows a fake bot-protection page followed by a fake verification pop-up. The page places a command in the clipboard and instructs the user to paste it into Terminal (ClickFix). While the fake page is displayed, the host sends frequent POST requests to the campaign domain reporting user information and actions (SANS ISC 2026-09-22). Fake-CAPTCHA domains rotate (velvet-otter-glagceis[.]life, hollow-badger-moasfraum[.]life, and quill-kraee-um2gf[.]pro on 2026-11-11). Huntress observed the lure arriving through an emailed link and the infrastructure hosted on AS210644 (Aeza Group).

Execution chain: The pasted command downloads a Bash script (about 4.7-5 KB) from a staging IP (45.150.33.128, 45.131.215.56, 45.150.32.130 in successive diaries) using URLs with a '?force=1' query. The script profiles the host and runs 'uname -m' to select an arm64 or x86_64 Mach-O (about 33-35 MB each, Go-built), saves it under a fake Apple-looking path in Library/Caches (e.g. com.apple.securityd/com.apple.periodic, com.apple.update), and kills any process already using that name. A base64-encoded string in the script decodes to the C2 URL, an /api/t endpoint on TCP 8133. The implant reports status stages (download success, exec_start, exec_ok). Huntress reported that the loader also deleted itself, cleared Terminal history and screen, stripped quarantine attributes, and created a folder mimicking com.apple.trustd.

Privilege and credential theft: The malware displays fake macOS dialogs (osascript-style 'System Error' / Keychain password prompts) to harvest the administrator password, and triggers TCC permission requests for Notes, Documents, Desktop, Downloads, Music and Photos (SANS ISC 2026-09-25). Huntress reported theft of browser password stores, Apple Keychain data and cached browser cookies.

Persistence: A LaunchAgent plist named com.apple.softwareupdated.plist launches a persisted copy at ~/Library/Caches/com.apple.softwareupdate/SoftwareUpdate; Huntress notes registration through launchctl bootstrap and the macOS Background Task Management subsystem, with the binary ad-hoc signed.

C2 and exfiltration: HTTP POST to /api/t (beacon/status), POST to /api/credentials (exfiltration, response 'upload_session_ok'), GET /api/shell/agent (remote shell agent), WebSocket upgrade requests, User-Agent 'Go-http-client/1.1', and HTTPS lookups to ipinfo.io. C2 hosts observed: 95.163.153.80:8133 (September), 138.124.118.69:8133 (Huntress), 171.22.131.24:8133 (November).

DRAIN function (Huntress): The Go stealer, obfuscated with Go Garbler, queries blockchains for candidate wallet balances and, when funds exist, redirects all or part to attacker wallets taken from a hardcoded list or the C2. A DRAIN_PCT variable controls the percentage (helpers compute 1% of balance) enabling slow partial depletion. Routines cover UTXO chains (Bitcoin, Litecoin, Dogecoin), Ethereum and XRP. At publication none of the hardcoded attacker wallets had received funds.

Attribution/naming caveats: No threat actor is attributed in the sources. SANS ISC first attributed the campaign's payload to an AMOS variant (citing Ransom-ISAC) then concluded it was not AMOS (different persistence, WebSocket/credential exfiltration, single-architecture Mach-O). The 'DownTheDRAIN' name is the SANS ISC author's nickname based on the Huntress analysis; the link between the Huntress sample and the Macfinger payloads rests on shared traits (port 8133 /api/t C2, com.apple.softwareupdated.plist persistence, Library/Caches masquerading, Go Mach-O) and the ISC author's naming, not a vendor-confirmed family match. In the 2026-11-11 test on macOS 26.7.3 the OS blocked the binary and moved it to Trash after four POSTs to the C2 and before exfiltration. Exact ClickFix command text was not published in the sources.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.003 Clear Command History; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information

Credential Access

T1056.002 GUI Input Capture; T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers

Execution

T1059.002 AppleScript; T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols

Discovery

T1082 System Information Discovery

Persistence

T1543.001 Launch Agent

Impact

T1657 Financial Theft

Remediation

Immediate actions

• Block egress to the listed IPs (including TCP 8133) and fake-CAPTCHA domains at DNS/proxy/firewall
• Hunt macOS endpoints for ~/Library/Caches/com.apple.update, com.apple.securityd/com.apple.periodic, com.apple.softwareupdate/SoftwareUpdate and ~/Library/LaunchAgents/com.apple.softwareupdated.plist
• If a user pasted a command from a CAPTCHA page, isolate the Mac, rotate browser-saved passwords, Keychain secrets and session cookies, and move crypto assets to new wallets
• Remove the persisted binary and LaunchAgent plist

Workarounds

• Restrict Terminal use and TCC permissions via MDM where feasible
• Never enter the administrator password into unexpected 'System Error' or Keychain dialogs

Longer-term hardening

• Train users that legitimate CAPTCHAs never ask them to paste commands into Terminal
• Alert on curl piped to bash/sh or base64-decoded command lines launched from Terminal on macOS
• Keep macOS current; the 2026-11-11 sample was blocked by macOS 26.7.3
• Use DNS filtering and script blocking against newly registered ClickFix domains

Affected and fixed versions

• Apple — macOS (Apple Silicon arm64 and Intel x86_64)
  Vulnerable versions: Hosts where the user pastes the ClickFix command; observed on macOS 26.7.3 and 27.0

Timeline

• 2026-03-01 Approximate date (about three months before discovery, per Huntress) of the infection of the victim host later analyzed by Huntress; exact day not stated.
• 2026-08-06 Huntress publishes 'Mac crypto-draining malware' describing the Go stealer with the DRAIN function, Aeza-hosted infrastructure and IOCs (found in a retrospective hunt in June 2026).
• 2026-09-22 SANS ISC publishes first Macfinger ClickFix diary (activity 2026-09-21/22): injected JavaScript on legitimate sites, fake CAPTCHA at locked-ioc-18, payload initially linked to AMOS.
• 2026-09-24 SANS ISC infects a macOS 27.0 test host from locked-ioc-17, observing LaunchAgent persistence, fake password prompts, /api/credentials exfiltration and C2 at locked-ioc-25:8133.
• 2026-09-25 SANS ISC publishes 'A Closer Look at Malware From the Macfinger ClickFix Campaign', concluding the malware is not an AMOS variant and remains unidentified.
• 2026-11-11 New sample observed from fake CAPTCHA domain locked-ioc-19 with staging IP locked-ioc-22 and C2 locked-ioc-23:8133; macOS 26.7.3 blocked the binary and moved it to Trash after four C2 POSTs.
• 2026-11-13 SANS ISC publishes the diary naming the malware 'DownTheDRAIN' (based on Huntress's DRAIN function) with new IOCs.

Sources cited

• SANS ISC Diary: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS isc.sans.edu · Research · 2026-11-13
• Huntress: Mac crypto-draining malware Huntress · Research · 2026-08-06
• SANS ISC Diary: A Closer Look at Malware From the Macfinger ClickFix Campaign isc.sans.edu · Research · 2026-09-25
• SANS ISC Diary: Macfinger ClickFix campaign (initial analysis) isc.sans.edu · Research · 2026-09-22
• SOC Prime: Macfinger ClickFix Campaign - Analyzing the Malware socprime.com · Blog · 2026-09-26

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• XLoader (v8.9) infostealer delivered via purchase-order phishing DOCX exploiting CVE-2017-11882 Previous report
• REF3364 SANSAR: Linux GPU Cryptomining Intrusion Falsifies NVIDIA GPU Telemetry via Malicious NVML Wrapper and ftrace Rootkit Next report

Further reading

• Matryoshka ClickFix: macOS AppleScript Stealer