Cyber ·
Macfinger ClickFix campaign distributes the DownTheDRAIN infostealer to macOS
A SANS Internet Storm Center diary entry describes the Macfinger campaign, which uses the ClickFix technique to distribute the DownTheDRAIN infostealer to macOS computers. The available text gives no additional details.
Radar records, from a SANS Internet Storm Center diary entry published on 13 November 2026, a campaign called Macfinger. According to the title, it uses the ClickFix technique to distribute the DownTheDRAIN infostealer to macOS computers. Infostealers are programs that seek credentials, session cookies and other data stored on the device. The available text gives no additional details about the initial access vector, the malware version, technical indicators or attribution of the campaign.
To consult and verify, read the original entry on the SANS Internet Storm Center site, in the diary section, using the title and date above, and compare with other sources before acting. The privacy angle is secondary: Rota Nacional does not detect or block malware and does not replace antivirus or EDR. Still, ClickFix techniques often lead users to paste commands into a terminal, so do not run commands copied from web pages or alerts. If you use AI to study the material, do not paste credentials, tokens or customer data into the prompt.
Original source: Campanha Macfinger ClickFix distribui o infostealer DownTheDRAIN para macOS