macOS ClickFix Campaign Evolves to Cloak Malicious Lures with Browser Fingerprinting
A sophisticated macOS ClickFix campaign is now using server-side browser fingerprinting to hide its malicious lures, serving them only to visitors who appear to be genuine macOS users.
Microsoft Threat Intelligence has identified a significant evolution in a macOS ClickFix campaign that distributes information-stealing malware such as MacSync and Atomic Stealer (AMOS). The campaign, which utilizes a large cluster of algorithmically generated domains, has shifted its tactics from openly serving malicious commands to employing a server-side browser-fingerprinting gate. This new technique allows the campaign to selectively display its lures, primarily to visitors whose browser environment closely matches that of a genuine macOS user, thereby limiting visibility for automated analysis tools and sandboxes.
The ClickFix social-engineering technique involves tricking users into executing commands in their Terminal application. This method bypasses traditional macOS security measures like quarantine handling, code-signing checks, and notarization, which are typically applied to downloaded applications. In this evolved campaign, the malicious command is no longer presented to every visitor. Instead, the campaign first profiles visitors through a fingerprinting gate. Only those deemed to be using a genuine macOS browser environment are presented with the fake "Download for macOS" page and the subsequent Terminal command.
This cloaking mechanism means that automated scanners and security researchers may encounter benign or decoy pages when probing the campaign's infrastructure. For instance, requests originating from Windows browsers have been observed to receive decoy pages impersonating VPN services or unrelated businesses, rather than the ClickFix lure. This server-side decision-making process, executed on a per-request basis, ensures that an apparently safe response does not guarantee the safety of the domain.
The campaign's domains exhibit a recognizable naming pattern, often incorporating the token "file" followed by dictionary-style words, such as filecopperbasket or filevelvettractor. While this pattern is useful for hunting and clustering related activity, the more critical development is the adoption of the fingerprinting gate. This shift provides a clear before-and-after view of the operation, highlighting the threat actors' efforts to evade detection.
The infection chain ultimately leads to the delivery of information-stealing malware. The campaign's infrastructure has been observed to host over 250 front-end domains during the tracking period, many of which follow the described naming convention. Defenders are advised to treat this naming pattern as a hunting pivot, but to prioritize the detection of the fingerprinting gate behavior and the overall infrastructure patterns.
Microsoft has provided detailed hunting guidance, mitigation recommendations, and defanged indicators of compromise to help defenders identify and protect against this evolving threat. The campaign's reliance on user-executed commands and its sophisticated evasion techniques underscore the persistent threat posed by macOS malware and the need for continuous adaptation in defensive strategies.
This development represents a broader trend in macOS ClickFix operations, where threat actors are increasingly instructing users to run Terminal commands for payload retrieval, moving away from traditional disk image delivery methods. The adoption of server-side cloaking by this specific cluster demonstrates a growing sophistication in evading automated analysis and maintaining operational security.
The latest observations reveal that this macOS ClickFix campaign has expanded its infrastructure to encompass over 250 distinct domains. This significant increase in front-end domains allows the operation to more effectively fingerprint visitors, tailoring the delivery of deceptive software download lures only to genuine macOS users while evading automated security analysis.