Threats · 8h ago

Macfinger ClickFix uses fake CAPTCHA to deliver Mac infostealer

On November 11, Brad Duncan analyzed a DownTheDRAIN infostealer sample delivered by the Macfinger ClickFix campaign. His Mac mini running macOS 26.7.3 blocked the malware and moved it to Trash before it could exfiltrate sensitive data; that test does not establish how other Macs would fare.

The fake CAPTCHA asks victims to copy instructions into Terminal to prove they are human. Those instructions actually run a command that retrieves and installs the infostealer. Huntress’s analysis found a function that identifies cryptocurrency wallet addresses and can redirect their contents to an attacker-controlled wallet.

For Mac users, the infection hinges on following a familiar verification prompt, not on silently bypassing macOS defenses. A user who runs the command could expose sensitive data or cryptocurrency, while Duncan’s single blocked sample leaves protection on other versions and devices unsettled.

Timeline

• Nov 13 Reported by SANS ISC

Sources

1 source covering this story

• SANS ISC Nov 13

  Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS

  Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, Author: Brad Duncan

Part of the PlainSec briefing for 2026-11-13

Editions

• Briefing for 2026-11-13

Related stories

• ScreenConnect malware spreads through technicians’ support sessions
• Cairn scales tailored intrusions across 19 organizations
• Silent Lynx used one rail account to reach government files