MacOS Users Targeted in New Malware Campaign
A recent cyberattack has been targeting MacOS users through a campaign known as Macfinger ClickFix. The malware, dubbed DownTheDRAIN infostealer, is designed to steal sensitive information from infected computers. The attack vector involves tricking victims into clicking on a fake CAPTCHA page that prompts them to install software updates.
The malware’s functionality was revealed by Huntress Cybersecurity in an analysis of one of the samples. According to the report, DownTheDRAIN infostealer has a “DRain” function that identifies cryptocurrency wallet addresses and redirects their contents to a wallet controlled by the attackers. This suggests that the primary goal of the attack is financial gain.
This is not the first time we’ve seen the Macfinger ClickFix campaign in action. The malware was initially identified back in September, but it didn’t match any known MacOS infostealers at the time. It’s only now, with further analysis, that its true nature has been revealed.
The DownTheDRAIN infostealer uses a combination of shell scripts and Mach-O executables to infect the computer. Once installed, it saves itself in the infected host’s Library/Caches directory before being blocked and moved to Trash by MacOS’s built-in security features. However, this doesn’t mean that all affected computers have been completely cleaned – the malware may still be able to exfiltrate sensitive data.
The attack is notable for its ability to evade detection by some security software. This highlights the ongoing challenge of staying ahead of sophisticated cyber threats. If you’re a MacOS user, it’s essential to remain vigilant and take steps to protect yourself from these types of attacks.
For those who may have been affected by this campaign, be aware that your computer may still contain remnants of the malware. It’s crucial to run a full system scan with reputable antivirus software to detect and remove any remaining threats. Additionally, make sure to update your operating system and other applications regularly to prevent similar attacks in the future.
By being informed and proactive about cybersecurity threats, we can all play a role in protecting ourselves and our communities from these types of malicious campaigns.
Source: SANS ISC — 2026-11-13