Macfinger ClickFix delivers macOS DownTheDRAIN stealer
A ClickFix social-engineering campaign tricks macOS users into running terminal commands that install the DownTheDRAIN infostealer targeting crypto wallets.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
SANS ISC analyst Brad Duncan details a new sample from the ongoing Macfinger ClickFix campaign, first observed in September 2026, which uses a fake CAPTCHA page to trick macOS users into pasting and executing a malicious command in Terminal. The command downloads a Bash shell script that installs a Mach-O arm64 binary the author has nicknamed 'DownTheDRAIN infostealer' based on a 'DRAIN' function described in earlier Huntress research, which identifies cryptocurrency wallet addresses and redirects their contents to attacker-controlled wallets.
In the analyzed case, the malware was downloaded and saved to $HOME/Library/Caches/com.apple.update, generated four HTTP POST requests to a C2 endpoint before macOS's built-in protections detected and quarantined it to Trash, preventing exfiltration. Infrastructure includes a fake-CAPTCHA domain, a delivery server hosting the shell script and binary, and a separate C2 server receiving POST requests via /api/t.
Defenders should treat ClickFix-style campaigns (fake CAPTCHA/verification pages instructing users to paste commands into Terminal or Run dialogs) as a recurring initial-access vector for macOS and should monitor for shell script execution originating from browser-copied clipboard content, unexpected Mach-O binaries in Library/Caches, and outbound connections to the listed IPs. The malware specifically targets cryptocurrency wallets, so crypto-holding users are at elevated risk.
Mentioned in this report
Detection guidance
macOS Shell Piping or Substituting a Remote Download into an Interpreter
A behavioural hunt for the technique in general.
Detects a bash/zsh/sh -c command line that downloads with curl or wget and executes the result inline, as in ClickFix fake-CAPTCHA paste-and-run lures on macOS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Shell Piping or Substituting a Remote Download into an Interpreter
description: Detects a shell started with -c whose command line fetches content with
curl or wget and executes it inline via command substitution or a pipe into a shell.
This is the typical command pasted into Terminal in ClickFix fake-CAPTCHA campaigns
that deliver macOS stealers.
tags:
- attack.execution
- attack.t1204.004
- attack.t1059.004
logsource:
category: process_creation
product: macos
detection:
selection_shell:
Image|endswith:
- /bash
- /zsh
- /sh
CommandLine|contains: ' -c '
selection_fetch:
CommandLine|contains:
- 'curl '
- 'wget '
selection_exec:
CommandLine|contains:
- $(curl
- $(wget
- '| bash'
- '|bash'
- '| sh'
- '| zsh'
filter_homebrew:
CommandLine|contains: Homebrew/install
condition: selection_shell and selection_fetch and selection_exec and not filter_homebrew
falsepositives:
- Developers running vendor install one-liners (for example rustup or nvm installers)
from Terminal
- Configuration management or bootstrap scripts that curl and pipe to a shell
level: medium
id: db08df78-79d1-5991-92e3-17cc07604ae9
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33518
macOS Binary Executed from User Library Caches Directory
A behavioural hunt for the technique in general.
Detects a process launched from a binary inside a Library/Caches path, where infostealers like DownTheDRAIN drop Mach-O payloads under Apple-looking names. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Binary Executed from User Library Caches Directory
description: Detects execution of a binary located under a Library/Caches directory.
The Macfinger ClickFix chain saved its Mach-O stealer under the user's Library/Caches
directory with an Apple-looking name and executed it. Legitimate applications rarely
run executables from cache folders, apart from known updater frameworks.
tags:
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: macos
detection:
selection:
Image|contains: /Library/Caches/
filter_sparkle:
Image|contains:
- org.sparkle-project.Sparkle
- /Library/Caches/Homebrew/
condition: selection and not filter_sparkle
falsepositives:
- Application auto-updaters that stage and run installers from their cache folder
- Developer tooling that runs build outputs from cache directories
level: medium
id: 7c48b62e-da1e-506a-be7f-95eb291dfe2e
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33518
macOS Executable Dropped as com.apple.update in Library Caches
A behavioural hunt for the technique in general.
Detects creation of a file named com.apple.update directly in a Library/Caches folder, masquerading as an Apple component as the DownTheDRAIN stealer does. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Executable Dropped as com.apple.update in Library Caches
description: Detects creation of a file named com.apple.update directly inside a Library/Caches
directory. Real Apple cache entries with com.apple names are folders, so a file
with this name matches the masquerading payload path used by the DownTheDRAIN infostealer.
tags:
- attack.stealth
- attack.t1036.005
- attack.collection
- attack.t1005
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|endswith: /Library/Caches/com.apple.update
condition: selection
falsepositives:
- Unlikely, since Apple software does not normally store a regular file with this
name in the user Caches root
level: high
id: 2a6eb4a9-3d4e-5236-abb3-761a74e6b5d0
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33518
3 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33518
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs