macOS ClickFix drops DownTheDRAIN, a crypto-draining stealer

ClickFix — the fake-CAPTCHA lure that gets a user to paste a command into a terminal — has been a Windows problem for most of its run. A fresh sample pulls it firmly onto macOS. SANS Internet Storm Center handler Brad Duncan analyzed a Macfinger ClickFix page caught on 2026-11-11 that drops a macOS infostealer he nicknames DownTheDRAIN, after the crypto-draining DRAIN routine first documented in a Huntress analysis. The names are Duncan's and Huntress's labels, not vendor identifiers. We flag it as a beat post because the technique — not the single sample — is the story: a Go-based macOS stealer that takes a configurable percentage of a victim's wallet rather than the whole balance, delivered by a lure most Mac users still think only hits Windows.

How the lure works

The Macfinger domain serves a fake CAPTCHA page that tells the visitor to paste text into Terminal. Duncan's write-up shows the fake CAPTCHA and the pasted command via screenshots and does not reproduce the command string; the pasted command retrieves a shell script, which in turn pulls a Mach-O arm64 binary. On Duncan's macOS 26.7.3 test host, the OS flagged the binary and moved it to Trash before exfiltration completed — but not before it generated outbound POSTs.

Per Huntress's earlier analysis of the same family, the payload harvests browser passwords, Keychain data and cached cookies, then runs the DRAIN function: it identifies likely wallet addresses for several cryptocurrencies, checks balances on-chain, and redirects funds to an attacker wallet. Huntress noted it as the first crypto drainer it had seen that can skim a set percentage instead of emptying the wallet — quieter, and harder to notice.

Indicators of compromise

Published verbatim by Brad Duncan, SANS ISC diary 33518 (defanged as in the source):

Domain:
  quill-kraee-um2gf[.]pro

URLs:
  hxxp[:]//45.150.32[.]130/37339606cba4522a?force=1   (shell script)
  hxxp[:]//45.150.32[.]130/4be1066a49e75?force=1      (infostealer binary)
  hxxp[:]//171.22.131[.]24:8133/api/t                 (HTTP POST, C2)

SHA-256:
  58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db  (5,011-byte shell script)
  8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd  (Mach-O arm64, 35,143,984 bytes)
  c34cc30cb1cff5c47d77e62a3ba63e9a183989ec1ccdf7929beb1bcae0d41f23  (Mach-O arm64, 34,957,760 bytes)

On-host path:
  $HOME/Library/Caches/com.apple.update

What to do

1. Block the network indicators above, especially the POST to 171.22.131[.]24:8133/api/t and the 45.150.32[.]130 payload host.
2. Alert on the on-host path $HOME/Library/Caches/com.apple.update — a legitimate-looking name in a cache directory is the persistence tell here.
3. Treat "paste this into Terminal" as hostile by default on macOS, exactly as you would a "paste into Run" prompt on Windows. Brief crypto-holding and developer staff specifically; they are the target set.
4. If a Mac ran the command, rotate browser-stored and Keychain credentials, check every crypto wallet reachable from that host for unauthorized outbound transfers, and treat the machine as compromised regardless of whether XProtect quarantined the binary — the POST fired before quarantine on Duncan's host.

Context

Two things make this worth an operator's attention. First, ClickFix on macOS is no longer a curiosity: Huntress dated this family to mid-2026 and BleepingComputer and others covered the ClickFix-to-macOS-stealer shift in August — Duncan's fresh sample shows it is still being actively seeded. Second, the crypto angle lines up with the day's other news: the DOJ's $1.2 billion Binance seizure is the state-actor end of crypto theft; a percentage-skimming drainer handed to anyone who runs a ClickFix lure is the commodity end. Both are betting the victim never notices the balance move.