Fingerprinting Gate Hides macOS ClickFix Malware From Security Tools

Microsoft has identified a macOS-focused ClickFix operation using more than 250 front-end domains to screen visitors before displaying a malicious lure. The campaign’s infrastructure fingerprints browsers and devices server-side, helping attackers avoid crawlers, automated sandboxes and researchers while selectively targeting people who appear to be using genuine Mac hardware.

In the activity analyzed by Microsoft, qualifying visitors were shown a GitHub-style page advertising a macOS download and displaying a counterfeit “Verified Publisher” badge. The broader domain cluster has been associated with MacSync and Atomic Stealer (AMOS), although Microsoft said it has not linked every domain to a specific payload. The company also did not disclose victim totals, targeted organizations or the operators’ identities.

Fingerprinting selects the response

The roughly 2.5-kilobyte JavaScript gate examines browser and system characteristics including the reported platform, screen and window dimensions, WebGL information, timezone, iframe status and touch support. Additional checks look for signs of analysis, such as an open developer console or unusual responses from browser media-capability tests.

The collected information is submitted automatically, with the server determining what content to return. Unwanted visitors may receive an empty page, a fake extension, or an unrelated legitimate-looking website. As a result, the same domain can appear harmless during one visit and deliver a malware lure during another. Microsoft noted that domain names containing “file” and ordinary dictionary words are a possible hunting clue, but should not be treated as proof of compromise on their own.

Terminal execution remains essential

The attack still depends on social engineering. The victim is instructed to copy an obfuscated command into macOS Terminal and execute it. In the analyzed chain, the command contacted a /curl/<id> endpoint, downloaded additional scripts and ultimately launched AMOS. The stealer can seek browser credentials, authentication data, cryptocurrency wallets, sensitive files and other stored information.

Defenders should investigate unusual Terminal activity following suspicious browsing, including curl piped to zsh, Base64 decoding, osascript, archive creation and outbound POST requests. Hunting for fingerprint forms, hidden fields, the mode:"php" marker and shared staging paths may be more effective than blocking disposable domains individually.

Users should reject any website, CAPTCHA, chat message or download prompt that asks them to paste commands into Terminal. Microsoft said recent macOS protections can warn about suspicious browser-originated pastes, while XProtect can inspect related processes and network activity. The fingerprinting layer changes how the lure is exposed, but not the central requirement that the user run the command.