macOS Malware Wallet Draining via DRAIN_PCT Function

Kaung Khant Ko@kaungkhantko

•updated Aug 10, 2026•1•0•7

This rule detects execution of macOS processes that contain specific strings associated with cryptocurrency wallet-draining malware (e.g., 'DRAIN_PCT', 'DRAIN_FUNCTION'). It monitors process creation command-line arguments to identify attempts by malicious software to execute functions intended to empty victim crypto wallets.