More than 250 front-end domains in a single macOS-focused ClickFix operation now fingerprint visitors and selectively serve a malware lure only to browsers that look like real Macs, Microsoft reported in an analysis published August 5.
Microsoft's timeline and what it observed
Microsoft Threat Intelligence monitored this ClickFix cluster for several weeks and documented a shift in the infrastructure during that window. Earlier variants exposed the malicious instructions, clipboard logic, an obfuscated shell command, and an encoded staging address directly in HTML—items static scanners could recover. Over the monitored period the operators added a server-side gate that fingerprints visitors and decides, per-request, whether to show the malicious lure or an innocuous page.
Microsoft confirmed more than 250 front-end domains during the tracking window. Many of the domain names combine the word "file" with dictionary terms—examples the company listed include filecopperbasket[.]sbs and applefilevault[.]com — but Microsoft cautioned the name pattern alone is only a hunting lead. The higher-confidence signal mixes disposable names, shared infrastructure behavior, and the fingerprinting gate.
How the fingerprinting gate decides what to show
The gate is a roughly 2.5 KB JavaScript bundle that collects navigator values such as the platform string (the script expects a Mac to report MacIntel), screen and window dimensions, and WebGL graphics signals intended to distinguish real Apple hardware from virtual machines or emulators. It also checks timezone, whether the page is loaded inside an iframe, and whether touch support is present—desktop Macs generally do not report touch.
The bundle includes two probes explicitly aimed at analysts: a counter that increases when the browser's developer console is open, and a repurposed call to canPlayType("video/mp4") used as a tripwire to flag stealth browsers faking codec support. The bundle is tagged mode:"php" and sent to the server; the server then chooses the response without additional user interaction.
Responses vary. A crawler, sandbox, or visitor from an "unwanted" context may receive a blank page, a fake browser extension page, or an unrelated business site. A request that looks like a genuine Mac in the expected browsing context gets a GitHub-themed "Download for macOS" page that includes a forged "Verified Publisher" badge. As Microsoft Security Research and Srinivasan Govindarajan put it, "An apparently benign or look-alike response does not mean the domain is safe." Because the decision happens server-side, two visits to the same address can produce entirely different pages.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleFrom lure to malware: the Terminal command and AMOS
The lure still requires an interactive step: the user must copy and paste an obfuscated command into Terminal. If run, that command fetches additional scripts from a /curl/<id> path, retrieves staging scripts, and launches an infostealer. In the chain Microsoft analyzed the final payload was Atomic Stealer (AMOS). The broader cluster has also distributed MacSync, though Microsoft did not map every domain to a specific payload.
Microsoft did not disclose victim counts, targeted sectors, or the operators' identities. The report maps the infrastructure and mechanism but leaves the campaign's scale and authorship undisclosed.
Defender guidance and Apple mitigations
Microsoft recommended defenders hunt for the gate artifacts rather than rely on chasing ephemeral front-end domains. Indicators to watch for include self-submitting fingerprint forms, hidden fingerprint fields, and the mode:"php" artifact. Blocking shared staging infrastructure and the /curl/ retrieval paths is likely to be more effective than blocking throwaway domain names.
On the endpoint side, defenders should look for browsing activity followed by unusual Terminal behavior—especially curl piped into zsh, Base64 decoding operations, osascript usage, archive creation, and subsequent outbound HTTP POST requests.
Apple addressed related behaviors in macOS 26.4, released March 24, 2026, and documented protections on August 3. According to Apple’s documentation cited by Microsoft, Terminal will show a confirmation prompt for users who have not opened it in more than 30 days, who lack common developer tools, or who paste from browsers or messaging apps; XProtect can also trace commands pasted into terminal emulators, inspect the process tree and network artifacts, and block activity linked to known malware.
What this means for security teams, enterprises, and end users
- Security teams: Prioritize detection of the fingerprinting gate and the shared staging infrastructure (/curl/ paths, mode:"php") over low-value domain takedowns. Monitor for the specific Terminal behaviors Microsoft highlighted.
- Enterprises and procurement leaders: Ensure endpoint controls and detection rules account for post-browse Terminal activity, and verify that macOS protections such as the Terminal prompts and XProtect tracing are in place and understood by desktop teams.
- End users: Do not paste or run commands you do not understand. Microsoft’s explicit advice: users should not follow any website, CAPTCHA, chat, or download instruction that asks them to paste text into Terminal.
The technical change Microsoft documented—the addition of a browser fingerprinting gate—appears crafted to defeat automated analysis and hide throwaway infrastructure, not to alter the social-engineering step at the heart of the attack. The lure still depends on a person pasting and running a command; refusing that step remains the simplest and most effective protection. For defenders, the practical takeaway is clear: hunt the gate and the staging paths, not just the front doors.
https://thehackernews.com/2026/08/over-250-clickfix-domains-use-browser.html
