Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)

The Macfinger ClickFix campaign is distributing a macOS infostealer, nicknamed DownTheDRAIN, through fake CAPTCHA pages that instruct victims to paste a command into Terminal. Its DRAIN function identifies cryptocurrency wallet addresses and can redirect their contents to a wallet controlled by the threat actor, according to Huntress analysis cited by SANS. In the reviewed example, macOS blocked the malware and moved it to Trash before it could exfiltrate data.