More than 250 ClickFix domains are using browser fingerprinting to hide macOS malware lures from security scanners.
Microsoft Threat Intelligence said the campaign checks visitors for signs of a genuine Mac before serving malicious instructions that can lead to the download of Atomic Stealer or MacSync.
Crawlers, sandboxes, and researchers may instead receive blank pages or benign-looking decoys, making the infrastructure harder to detect and investigate.
ClickFix domains screen visitors before showing the lure
Microsoft said the campaign’s earlier phase exposed its malicious instructions, clipboard logic, shell command, and staging address directly in the page’s HTML.
The operators later placed a server-side gate in front of the ClickFix lure. A lightweight JavaScript routine collects information about each visitor and sends the results to the server, which determines what content to return.
The checks include the browser’s reported platform, screen dimensions, window size, timezone, touch support, and WebGL graphics information. The script also looks for signs that the page is running in an iframe, a virtual machine, an emulated environment, or a browser with developer tools open.
A visitor who appears to be using a genuine Mac may receive a GitHub-themed download page with a fake verified-publisher badge. Other visitors may see an empty page, a fake browser extension, or an unrelated company website.
“An apparently benign or look-alike response does not mean the domain is safe,” Microsoft warned.
The attack still requires a Terminal command
The Hacker News noted that the fingerprinting gate changes how the malicious page is delivered, but the underlying ClickFix technique remains the same.
Victims are instructed to copy an obfuscated command and run it in the macOS Terminal. The command contacts a /curl/<id> path, retrieves additional scripts, and launches the payload.
Microsoft said the wider infrastructure cluster distributed MacSync and Atomic Stealer, also known as AMOS. The attack chain analyzed through the fingerprinting gate ended with AMOS.
The malware can target credentials, browser information, authentication data, cryptocurrency wallets, and sensitive files. Microsoft did not disclose the number of victims, targeted industries, or the identity of the campaign’s operators.
Defenders should hunt the gate, not only the domains
Many of the domains combine “file” with dictionary words, although Microsoft cautioned that the naming convention is only a hunting lead. Disposable domain names can change quickly, and some related domains do not follow the same pattern.
Security teams should instead correlate the naming behavior with the fingerprinting gate, shared staging infrastructure, self-submitting forms, hidden fingerprint fields, and the mode: “php” artifact.
Endpoint monitoring should also flag browsing activity followed by unusual Terminal behavior, particularly:
- curl commands piped into zsh
- Base64 decoding or osascript execution
- Archive creation followed by outbound HTTP POST traffic
Users should treat any website, CAPTCHA, chat message, or download page asking them to paste a command into Terminal as malicious.
The campaign shows why a clean scan cannot always clear a suspicious domain. When attackers choose what each visitor sees, defenders must examine browser behavior, infrastructure patterns, and endpoint activity together rather than trusting a single page response.
See how a DocuSign-themed phishing kit used legitimate remote monitoring and management tools to establish persistence across Windows and macOS devices.