Severity: High | Priority: 1
The Macfinger campaign injects script into legitimate, compromised websites. The script fingerprints visitors and shows macOS users a fake CAPTCHA page. The page tells the victim to paste a command into Terminal as a “verification” step. That command downloads a shell script, which then installs a Go-based Mach-O infostealer that researchers have named DownTheDRAIN. No software vulnerability is exploited. The attack relies entirely on a user running the command, so fully patched Macs in your network are still at risk.
Once installed, DownTheDRAIN steals browser-stored passwords, macOS Keychain data and cached credentials, and sends them to attacker-controlled servers. It also has a crypto-draining function. This can redirect all or only part of a wallet’s balance to the attacker, so a theft may go unnoticed for some time. The malware hides in a user cache directory under a name that looks like an Apple system file. It uses fake system prompts to capture the user’s administrator password.
These signatures detect DownTheDRAIN at several points in the infection chain, from the first visit to the fake CAPTCHA page through to an active infection. If an alert shows only that the lure site was reached, ask the user whether they pasted or ran anything in Terminal. If an alert shows the malware being downloaded or talking to its servers, treat the host as compromised: isolate it, and check for an unexpected executable at $HOME/Library/Caches/com.apple.update. Then reset every credential saved in the browser and Keychain on that machine, and move any cryptocurrency used from it to new wallets.
To reduce exposure, tell macOS users in your network that a real CAPTCHA or verification page never asks them to paste commands into Terminal. Ask them to close any page that does and report it.