Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)

The Macfinger ClickFix campaign distributes a macOS infostealer malware named DownTheDRAIN. This malware attempts to steal sensitive information, including cryptocurrency wallet addresses, redirecting their contents to attacker-controlled wallets. The malware is delivered via a shell script that installs the DownTheDRAIN binary. macOS 26.7.3 was observed blocking and moving the malware to Trash before data exfiltration could occur.

• isc.sans.edu/diary/rss/33518 (opens in a new tab)

• Capabilities and vulnerabilities of the Muse AI agent | Kaspersky official blogHighVulnerability2026-11-12
• Microsoft Fixes Nearly 1,100 Security VulnerabilitiesExploitedVulnerability2026-11-10
• CVE-2026-124848: Kiro CLI · Incorrect default permissions on session transcripts and prompt historyHighVulnerability2026-11-10
• ZDI-26-831: Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure VulnerabilityLowVulnerability2026-10-28
• iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18HighVulnerability2026-10-27