Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures Contact/Tip Us Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a comment/feedback! Follow Us On Social Media RSS Feeds Email Alerts Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures Swati Khandelwal Aug 05, 2026 Malware / Threat Intelligence A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download. Microsoft said the wider cluster distributed MacSync and Atomic Stealer (AMOS) ; the chain it analyzed through the gate ended in AMOS. The attack still requires the user to copy and run an obfuscated command in Terminal. That command retrieves scripts and launches an infostealer targeting credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files. Microsoft has not disclosed victim numbers, targeted sectors, or the identity of the operators. Users should not follow any website, CAPTCHA, chat, or download instruction that asks them to paste text into Terminal. Microsoft said in an analysis published August 5 that the infrastructure changed during several weeks of monitoring. Earlier pages exposed the ClickFix instructions, clipboard logic, obfuscated shell command, and encoded staging address directly in their HTML, making them easy for static scanners to recover. The gate’s script, about 2.5 KB of JavaScript, reads navigator values such as the platform string, which should report MacIntel on a real Mac, along with screen and window dimensions and WebGL graphics signals that help separate genuine Apple hardware from a virtual machine or an emulated environment. It checks the timezone, whether the page is boxed inside an iframe, and whether the device reports touch support, which desktop Macs generally do not. Two probes specifically hunt for analysts: a counter that ticks up when the browser’s developer console is open, and a call to canPlayType(“video/mp4″) repurposed as a tripwire that flags stealth browsers faking codec support in JavaScript. The bundle is tagged mode:”php” and sent back with no user interaction. The browser sends the fingerprint to the server, which chooses what the visitor sees. A crawler, sandbox, or visitor in an unwanted location may receive a blank page, fake browser extension, or unrelated business site. A request resembling a genuine Mac in the expected context receives a GitHub-themed “Download for macOS” page with a forged “Verified Publisher” badge. “An apparently benign or look-alike response does not mean the domain is safe,” Microsoft Security Research and Srinivasan Govindarajan, a senior security researcher at the company, said in the report. The decision happens server-side for each request, so two visits to the same address can produce entirely different pages. Microsoft confirmed more than 250 front-end domains during its tracking window. Many combine the word “file” with dictionary terms, including filecopperbasket[.]sbs and applefilevault[.]com. The company warned that the pattern is only a hunting lead. The stronger signal combines disposable names, shared infrastructure behavior, and the fingerprinting gate. Once a victim runs the command, it contacts a /curl/<id> path and retrieves further scripts before launching AMOS in the chain Microsoft analyzed. Microsoft said the wider domain cluster has also distributed MacSync , but it did not map every domain to a payload. Defenders should monitor for browsing followed by unusual Terminal activity, especially curl piped into zsh, Base64 decoding, osascript, and archive creation followed by outbound HTTP POST requests. Because the malicious page only appears for qualified visitors, the recommended move is to hunt the gate rather than the malware behind it: watch for self-submitting fingerprint forms, hidden fingerprint fields, and the mode:”php” artifact, and block on the shared staging infrastructure and /curl/ paths instead of chasing throwaway front-end domains. Apple released macOS 26.4 on March 24, 2026, and documented the protections in detail on August 3. Terminal shows a confirmation prompt for users who have not opened it in more than 30 days, lack common developer tools, and paste from browsers or messaging apps. Separately, XProtect can trace commands pasted into any terminal emulator, inspect their process tree and network artifacts, and block activity associated with known malware. The report maps the infrastructure and the mechanism, but not the scale of the campaign or who is running it, both of which Microsoft leaves undisclosed. On the evidence presented, the gate reads as a measure against automated analysis rather than a change to the attack itself: it hides the infrastructure from crawlers and sandboxes, while the lure served to a qualifying Mac and the requirement that the user paste and run the command are unchanged. Refusing that step is as protective as it was before. The operation extends a shift Microsoft documented in May , when macOS infostealer campaigns began using Terminal commands to fetch remote scripts instead of shipping a disk image to install by hand. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post. SHARE Tweet Share Share Share Share on Facebook Share on Twitter Share on Linkedin Share on Reddit Share on Hacker News Share on Email Share on WhatsApp Share on Facebook Messenger Share on Telegram SHARE Credential Theft , Cybercrime , endpoint security , Evasion , Infostealer , macos security , Malware , Social Engineering , Threat Intelligence , Web Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders Cybersecurity Webinars Risk in AI-Generated Code How to Secure AI Code Before It Reaches Production Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale. Register Build AI Securely How to Secure AI-Built Software at Machine Speed Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed. Register ⚡ Latest News Cybersecurity Resources 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Burp, sqlmap, SSRF, XXE, SSTI: Web Exploitation, Hands-On 35 labs plus a live CTF take you from recon to remote code execution. GWAPT prep, SANS CDI in D.C. SANS AI Cybersecurity Summit Returns This November Learn how practitioners are applying AI to today’s cybersecurity challenges. Expert Insights Articles Videos How AI-Assisted Attacks Are Breaking Legacy SIEM Tools August 3, 2026 Read ➝ A Look Inside Lasso’s AI Security Platform July 27, 2026 Read ➝ Claude Runs Across Six Surfaces in Your Company. Your Security Team Sees One. July 27, 2026 Read ➝ How to Make Social Engineering Unprofitable July 22, 2026 Read ➝ Get the Latest News in Your Inbox Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free. Email
Menu
