A recent macOS ClickFix campaign involving over 250 front-end domains now utilizes visitor fingerprinting before displaying a malware lure, a tactic closely monitored by Microsoft Threat Intelligence on infrastructure under observation for several weeks.
The server-side gate conceals the malicious page from crawlers and sandboxes, instead presenting selected Mac users with a fake software download. Microsoft identified the broader cluster as distributing MacSync and Atomic Stealer (AMOS), with the analyzed chain ultimately leading to AMOS.
To execute the attack, users are required to copy and run an obfuscated command in Terminal. This command retrieves scripts and initiates an infostealer targeting various sensitive data, including credentials, browser information, cryptocurrency wallets, and important files. Microsoft has refrained from disclosing specific details such as the number of victims, targeted sectors, or the identity of the threat actors.
It is crucial for users to avoid following any instructions on websites, CAPTCHAs, chats, or downloads that prompt them to paste text into Terminal.
In an analysis released on August 5, Microsoft noted that the infrastructure underwent significant changes over the monitoring period. Earlier iterations of the campaign exposed various components directly in the HTML, making them easily detectable by static scanners.
The gate’s script, approximately 2.5 KB in size, gathers information such as platform details, screen dimensions, and WebGL signals to differentiate between genuine Apple hardware and virtual environments. The script also checks for timezone, iframe containment, touch support, and developer console activity to identify potential analysts. The fingerprint is sent back to the server, which determines what content the visitor will see.
Microsoft identified over 250 front-end domains during its tracking, many of which combine the term “file” with common words. However, the company emphasized that this naming pattern is just one indicator, and a more robust signal is found in shared infrastructure behavior and the fingerprinting gate.
While the malware page is only displayed to qualified visitors, defenders are advised to focus on identifying the gate rather than the malware itself. Monitoring for specific activities in Terminal, such as curl commands, Base64 decoding, and outbound HTTP requests, can help detect suspicious behavior.
Apple’s macOS 26.4 update on March 24, 2026, introduced additional security measures, detailed on August 3. Users are advised to be cautious when pasting commands into Terminal and utilize tools like XProtect to trace and block malicious activity.
Microsoft’s report sheds light on the campaign’s infrastructure and tactics but stops short of revealing the campaign’s scale or the threat actors behind it. The gate appears to be a defensive measure against automated analysis, emphasizing the importance of user vigilance in preventing such attacks.
This operation builds upon a previous shift documented by Microsoft in May, where macOS infostealer campaigns transitioned to using Terminal commands for fetching remote scripts instead of traditional installation methods.
