# Macfinger ClickFix campaign delivers DownTheDRAIN crypto-draining infostealer for macOS

> A ClickFix campaign (tracked by SANS ISC as 'Macfinger') uses fake CAPTCHA pages to trick macOS users into pasting a command into Terminal, which fetches a shell script that installs an architecture-specific Go-based Mach-O infostealer. SANS ISC nicknamed the malware 'DownTheDRAIN' after the DRAIN function Huntress documented, which checks wallet balances and redirects funds to attacker-controlled wallets.

- **Published:** 2026-11-13T04:11:39Z
- **Last reviewed:** 2026-11-13T04:11:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5922
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5922.png
- **ID:** TL-2026-5922
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 28 (3 shown free below)

## Description

Delivery: Legitimate websites are injected with JavaScript that fingerprints visitors and, for macOS hosts, shows a fake bot-protection page followed by a fake verification pop-up. The page places a command in the clipboard and instructs the user to paste it into Terminal (ClickFix). While the fake page is displayed, the host sends frequent POST requests to the campaign domain reporting user information and actions (SANS ISC 2026-09-22). Fake-CAPTCHA domains rotate (velvet-otter-glagceis[.]life, hollow-badger-moasfraum[.]life, and quill-kraee-um2gf[.]pro on 2026-11-11). Huntress observed the lure arriving through an emailed link and the infrastructure hosted on AS210644 (Aeza Group).

Execution chain: The pasted command downloads a Bash script (about 4.7-5 KB) from a staging IP (45.150.33.128, 45.131.215.56, 45.150.32.130 in successive diaries) using URLs with a '?force=1' query. The script profiles the host and runs 'uname -m' to select an arm64 or x86_64 Mach-O (about 33-35 MB each, Go-built), saves it under a fake Apple-looking path in Library/Caches (e.g. com.apple.securityd/com.apple.periodic, com.apple.update), and kills any process already using that name. A base64-encoded string in the script decodes to the C2 URL, an /api/t endpoint on TCP 8133. The implant reports status stages (download success, exec_start, exec_ok). Huntress reported that the loader also deleted itself, cleared Terminal history and screen, stripped quarantine attributes, and created a folder mimicking com.apple.trustd.

Privilege and credential theft: The malware displays fake macOS dialogs (osascript-style 'System Error' / Keychain password prompts) to harvest the administrator password, and triggers TCC permission requests for Notes, Documents, Desktop, Downloads, Music and Photos (SANS ISC 2026-09-25). Huntress reported theft of browser password stores, Apple Keychain data and cached browser cookies.

Persistence: A LaunchAgent plist named com.apple.softwareupdated.plist launches a persisted copy at ~/Library/Caches/com.apple.softwareupdate/SoftwareUpdate; Huntress notes registration through launchctl bootstrap and the macOS Background Task Management subsystem, with the binary ad-hoc signed.

C2 and exfiltration: HTTP POST to /api/t (beacon/status), POST to /api/credentials (exfiltration, response 'upload_session_ok'), GET /api/shell/agent (remote shell agent), WebSocket upgrade requests, User-Agent 'Go-http-client/1.1', and HTTPS lookups to ipinfo.io. C2 hosts observed: 95.163.153.80:8133 (September), 138.124.118.69:8133 (Huntress), 171.22.131.24:8133 (November).

DRAIN function (Huntress): The Go stealer, obfuscated with Go Garbler, queries blockchains for candidate wallet balances and, when funds exist, redirects all or part to attacker wallets taken from a hardcoded list or the C2. A DRAIN_PCT variable controls the percentage (helpers compute 1% of balance) enabling slow partial depletion. Routines cover UTXO chains (Bitcoin, Litecoin, Dogecoin), Ethereum and XRP. At publication none of the hardcoded attacker wallets had received funds.

Attribution/naming caveats: No threat actor is attributed in the sources. SANS ISC first attributed the campaign's payload to an AMOS variant (citing Ransom-ISAC) then concluded it was not AMOS (different persistence, WebSocket/credential exfiltration, single-architecture Mach-O). The 'DownTheDRAIN' name is the SANS ISC author's nickname based on the Huntress analysis; the link between the Huntress sample and the Macfinger payloads rests on shared traits (port 8133 /api/t C2, com.apple.softwareupdated.plist persistence, Library/Caches masquerading, Go Mach-O) and the ISC author's naming, not a vendor-confirmed family match. In the 2026-11-11 test on macOS 26.7.3 the OS blocked the binary and moved it to Trash after four POSTs to the C2 and before exfiltration. Exact ClickFix command text was not published in the sources.

## MITRE ATT&CK

- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1543.001 Launch Agent
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1140 Deobfuscate/Decode Files or Information
- T1056.002 GUI Input Capture
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Macfinger ClickFix - Terminal curl Piped To Shell From Staging Host (DownTheDRAIN)** (`TL-2026-5922-SPL-001`)

Detects the ClickFix execution step of the Macfinger campaign (DownTheDRAIN infostealer) on macOS: a pasted Terminal command that uses curl with a '?force=1' URL piped into bash/sh/zsh, a base64-decoded payload piped to a shell, or curl against the known Aeza-hosted staging IPs (45.150.32.130, 45.131.215.56, 45.150.33.128, 193.29.224.151, 77.221.152.34). The downloaded 4.7-5 KB script selects an arm64 or x86_64 Go Mach-O and installs it under a fake com.apple path.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.004, T1140
- **Data sources:** osquery (index=macos sourcetype=osquery:results), macos_endpoint_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=macos sourcetype="osquery:results"
| eval cmd=lower('columns.cmdline'), usr='columns.username'
| where (like(cmd,"%curl%") AND ((like(cmd,"%force=1%") AND match(cmd,"[|] *(ba|z)?sh( |$|;)")) OR match(cmd,"(45[.]150[.]33[.]128|45[.]131[.]215[.]56|45[.]150[.]32[.]130|193[.]29[.]224[.]151|77[.]221[.]152[.]34)"))) OR (match(cmd,"base64 +(-d|--decode)") AND match(cmd,"[|] *(ba|z)?sh( |$|;)"))
| stats count as events min(_time) as first_seen max(_time) as last_seen values(cmd) as command_lines by host, usr
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - events
```

### Microsoft KQL

```kql
let StagingIPs = dynamic(['45.150.33.128','45.131.215.56','45.150.32.130','193.29.224.151','77.221.152.34']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath startswith '/'
| where (ProcessCommandLine has 'curl' and ((ProcessCommandLine contains 'force=1' and ProcessCommandLine matches regex '[|] *(ba|z)?sh( |$|;)') or ProcessCommandLine has_any (StagingIPs))) or (ProcessCommandLine has 'base64' and ProcessCommandLine matches regex '(?i)base64 +(-d|--decode)' and ProcessCommandLine matches regex '[|] *(ba|z)?sh( |$|;)')
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: macOS ClickFix Terminal curl Piped To Shell From Staging Host
id: 7c1e2a90-3b4d-4f6a-8e15-2a9d0c1b5f01
status: experimental
description: Detects Macfinger ClickFix execution on macOS where a pasted Terminal command uses curl with a force=1 URL piped into a shell, a base64 decoded payload piped into a shell, or curl against known staging IPs (TL-2026-5922).
references:
  - https://isc.sans.edu/diary/rss/33518
  - https://www.huntress.com/blog/mac-crypto-draining-malware
author: Threadlinqs Team
date: 2026/11/13
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.004
  - attack.t1140
logsource:
  product: macos
  category: process_creation
detection:
  selection_curl:
    CommandLine|contains|all:
      - 'curl'
      - 'force=1'
  selection_curl_any:
    CommandLine|contains: 'curl'
  selection_shell_pipe:
    CommandLine|contains:
      - '| bash'
      - '|bash'
      - '| sh'
      - '|sh'
      - '| zsh'
      - '|zsh'
  selection_b64:
    CommandLine|contains:
      - 'base64 -d'
      - 'base64 -D'
      - 'base64 --decode'
  selection_staging:
    CommandLine|contains:
      - '45.150.33.128'
      - '45.131.215.56'
      - '45.150.32.130'
      - '193.29.224.151'
      - '77.221.152.34'
  condition: (selection_curl and selection_shell_pipe) or (selection_curl_any and selection_staging) or (selection_b64 and selection_shell_pipe)
falsepositives:
  - Developers installing tools with curl-to-shell one-liners (for example Homebrew or rustup)
  - Administrators running base64-decoded provisioning scripts
level: high

```

**Known false positives:**

- Developers installing tools with curl-to-shell one-liners such as Homebrew or rustup
- Administrators running base64-decoded provisioning scripts from Terminal

**Tuning notes:** Adjust index/sourcetype and the columns.* field names to your osquery pack or EDR feed. Allowlist known package-manager URLs and managed-device script hosts. The exact ClickFix command text was not published, so the generic curl-pipe-shell clause is paired with the force=1 query and the staging IP list; refresh the IP list as the campaign rotates infrastructure.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Macfinger - Mach-O Stealer Executed From Fake com.apple Path In User Caches (locked: unlock with TL Creds)
- Macfinger - Quarantine Stripping, Shell History Wiping and Process Kill Of Fake Apple Names (locked: unlock with TL Creds)
- Macfinger - Outbound Connections From Fake com.apple Binary In User Caches (locked: unlock with TL Creds)
- Macfinger - Fake CAPTCHA Lure Domains and Staging Server Downloads (locked: unlock with TL Creds)
- Macfinger - osascript Fake Password Prompt and Keychain/Browser Credential Access (locked: unlock with TL Creds)
- Macfinger - Go-http-client Beaconing To TCP 8133 C2 (locked: unlock with TL Creds)
- Macfinger - com.apple.softwareupdated LaunchAgent Persistence (DownTheDRAIN) (locked: unlock with TL Creds)
- Macfinger - DownTheDRAIN HTTP C2 and Credential Exfiltration on TCP 8133 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 28)

Defanged, TLP:CLEAR.

- IP address: `45.150.32[.]130`
- Domain: `quill-kraee-um2gf[.]pro`
- File hash: `58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db`

Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SANS ISC Diary: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS](https://isc.sans.edu/diary/rss/33518)
- [Huntress: Mac crypto-draining malware](https://www.huntress.com/blog/mac-crypto-draining-malware)
- [SANS ISC Diary: A Closer Look at Malware From the Macfinger ClickFix Campaign](https://isc.sans.edu/diary/33368)
- [SANS ISC Diary: Macfinger ClickFix campaign (initial analysis)](https://isc.sans.edu/diary/33360)
- [SOC Prime: Macfinger ClickFix Campaign - Analyzing the Malware](https://socprime.com/active-threats/macfinger-clickfix-campaign-analyzing-the-malware/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5922