A November 13 SANS Internet Storm Center analysis examines a Macfinger ClickFix sample distributed two days earlier. Fake CAPTCHA instructions directed the user to paste commands into Terminal, retrieving a script and a macOS executable.
Researcher Brad Duncan calls the infostealer DownTheDRAIN. In his test, a Mac mini running macOS 26.7.3 blocked the malware and moved it to Trash before sensitive data was exfiltrated. That outcome describes this particular test, rather than protection guaranteed across all Macs.
The diary provides file hashes and network indicators for defenders, including the lure domain quill-kraee-um2gf[.]pro. The practical precaution is to reject CAPTCHA instructions that ask users to execute Terminal commands.
