Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
A macOS ClickFix campaign spanning 250+ front-end domains now uses server-side browser fingerprinting to selectively serve malicious lures only to genuine Mac users while hiding content from crawlers, sandboxes, and analysts The ~2.5 KB JavaScript gate probes navigator values, screen dimensions, WebGL signals, timezone, iframe embedding, touch support, developer console activity, and codec support to distinguish real Macs from virtual machines and stealth browsers Qualified victims receive a Git
Analysis
TL;DR
- A macOS ClickFix campaign spanning 250+ front-end domains now uses server-side browser fingerprinting to selectively serve malicious lures only to genuine Mac users while hiding content from crawlers, sandboxes, and analysts
- The ~2.5 KB JavaScript gate probes navigator values, screen dimensions, WebGL signals, timezone, iframe embedding, touch support, developer console activity, and codec support to distinguish real Macs from virtual machines and stealth browsers
- Qualified victims receive a GitHub-themed fake download page with a forged "Verified Publisher" badge and are tricked into pasting an obfuscated Terminal command that deploys the AMOS infostealer
- The fingerprinting gate represents an evasion upgrade against automated analysis rather than a change to the core attack chain, which still relies on social engineering to get users to run Terminal commands
- Apple's macOS 26.4 introduces a Terminal confirmation prompt for infrequent users and XProtect can trace and block commands pasted from browsers into terminal emulators
Why It Matters
This campaign illustrates the growing sophistication of macOS-targeted social engineering attacks, where threat actors are actively adapting evasion techniques to bypass automated security analysis and sandboxing. For defenders, it highlights the importance of hunting behavioral artifacts like self-submitting fingerprint forms and the mode:"php" indicator rather than chasing disposable front-end domains. The shift from disk image delivery to Terminal-based script fetching represents a broader trend in macOS malware distribution that security teams need to monitor closely.
Technical Details
- Browser fingerprinting gate: A ~2.5 KB JavaScript script reads
navigator.platform(expectingMacIntel), screen/window dimensions, WebGL graphics signals, timezone, iframe embedding status, and touch support. Two analyst-targeting probes include a developer console open-counter and a repurposedcanPlayType("video/mp4")call that flags stealth browsers faking codec support. Results are sent server-side withmode:"php"and no user interaction required. - Server-side content selection: Requests from crawlers, sandboxes, VMs, or unexpected locations receive blank pages, fake browser extensions, or unrelated business sites. Genuine Mac requests receive a GitHub-themed "Download for macOS" page with a forged "Verified Publisher" badge and ClickFix instructions.
- Payload chain: Victims who paste and run the obfuscated Terminal command trigger a
curlcall to a/curl/<id>path, which retrieves additional scripts and launches AMOS (Atomic Stealer), an infostealer targeting credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files. The broader cluster has also distributed MacSync. - Infrastructure: Over 250 front-end domains tracked, many combining "file" with dictionary terms (e.g.,
filecopperbasket[.]sbs,applefilevault[.]com). Microsoft recommends hunting shared staging infrastructure and/curl/paths rather than individual disposable domains. - Defensive indicators: Monitor for
curlpiped intozsh, Base64 decoding,osascript, archive creation followed by outbound HTTP POST requests, self-submitting fingerprint forms, hidden fingerprint fields, and themode:"php"artifact.
Industry Insight
- Security teams should prioritize behavioral detection of fingerprinting gates and shared staging infrastructure over domain-level blocking, as the disposable nature of front-end domains makes takedown efforts inefficient against this campaign structure.
- The macOS ecosystem is becoming an increasingly targeted surface for infostealer campaigns adopting evasion techniques previously more common in Windows threat operations; organizations should ensure Terminal usage policies and XProtect signatures are current, especially given macOS 26.4's new confirmation prompt protections.
- The evolution from disk image delivery to in-browser Terminal command injection reflects a broader shift toward lower-friction, script-based macOS malware distribution that reduces attacker operational overhead while maintaining effective social engineering vectors.
Disclaimer: The above content is generated by AI and is for reference only.