Essential Insights
- Macfinger ClickFix uses fake CAPTCHA instructions to trick users into pasting commands into Terminal, launching a shell-script installer.
- The installer downloads and runs an ARM64 macOS infostealer that targets sensitive data and can redirect cryptocurrency wallet contents to attacker-controlled wallets.
- The malware attempted HTTP POST traffic to
171.22.131[.]24:8133; macOS blocked it before the reported infection could exfiltrate data.
Threat, Techniques, and Targets
The Macfinger ClickFix campaign delivers DownTheDRAIN, an infostealer for macOS. On November 11, 2026, a fake CAPTCHA page instructed users to paste commands into Terminal. The commands downloaded a shell script, which then retrieved and installed an ARM64 malware file.
The malware’s DRAIN function identifies cryptocurrency wallet addresses and can redirect wallet contents to an attacker’s wallet. Therefore, macOS users who follow the fake CAPTCHA instructions face a risk of data theft and cryptocurrency loss.
Key indicators include:
• Network addresses: 45.150.32[.]130 and 171.22.131[.]24:8133
• Malware file SHA 256: 8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd
• Installed file path: $HOME/Library/Caches/com.apple.update
Impact, Security Implications, and Remediation
DownTheDRAIN may expose sensitive information and redirect cryptocurrency wallet contents. However, in the reported test, macOS 26.7.3 blocked the malware and moved it to Trash before it could send sensitive data. This result applies to that test system and does not establish protection on other devices.
Organizations should check network and file activity for the listed indicators. The source provides no broader cleanup or recovery steps. Therefore, obtain remediation guidance from Apple, your security vendor, or the relevant authority.
Stay Ahead with the Latest Tech Trends
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
