Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

Published:

5 augustus 2026 om 18:44:31

Alert date:

5 augustus 2026 om 20:02:16

Source:

thehackernews.com

Operating Systems, Ransomware & Malware, Web Technologies

A large-scale ClickFix operation targeting macOS users has been identified, utilizing over 250 front-end domains to distribute malware. The campaign employs server-side browser fingerprinting to selectively present malicious content only to targeted Mac users, effectively evading automated crawlers and sandboxes. Visitors are shown fake software download pages designed to trick them into installing malware. Microsoft Threat Intelligence has been tracking the infrastructure for weeks and documented this evolution in evasion techniques. The use of fingerprinting represents a significant operational security upgrade for the threat actors behind ClickFix campaigns, making detection and analysis more difficult for security researchers.

Technical details

A macOS ClickFix campaign spanning over 250 front-end domains uses server-side browser fingerprinting to selectively serve malware lures while hiding from crawlers and sandboxes. A ~2.5 KB JavaScript gate reads navigator platform strings (expecting 'MacIntel'), screen and window dimensions, WebGL graphics signals, timezone, iframe detection, and touch support to distinguish real Apple hardware from virtual machines. Two analyst-detection probes are used: a counter that detects when the browser developer console is open, and a canPlayType('video/mp4') call repurposed as a tripwire to flag stealth browsers faking codec support. The fingerprint bundle is tagged mode:'php' and sent to the server without user interaction. The server then decides the response: crawlers/sandboxes/unwanted visitors receive blank pages, fake browser extensions, or unrelated business sites, while qualifying Mac users receive a GitHub-themed fake 'Download for macOS' page with a forged 'Verified Publisher' badge. The attack requires the user to copy and paste an obfuscated command into Terminal. Once run, it contacts a /curl/<id> path to retrieve further scripts and ultimately deploys AMOS (Atomic Stealer) or MacSync infostealers. Payloads target credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files. Earlier campaign infrastructure exposed ClickFix instructions, clipboard logic, obfuscated shell commands, and encoded staging addresses directly in HTML. The campaign evolved in May 2026 to use Terminal commands fetching remote scripts instead of disk images.

Mitigation steps:

1. Do not follow any website, CAPTCHA, chat, or download instruction that asks you to paste text into Terminal. 2. Upgrade to macOS 26.4, which includes a Terminal confirmation prompt for users who have not opened it in more than 30 days, lack common developer tools, and paste from browsers or messaging apps. 3. Rely on XProtect, which can trace commands pasted into any terminal emulator, inspect process trees and network artifacts, and block known malware activity. 4. Monitor for browsing activity followed by unusual Terminal activity, especially: curl piped into zsh, Base64 decoding, osascript execution, and archive creation followed by outbound HTTP POST requests. 5. Hunt the fingerprinting gate rather than throwaway front-end domains: watch for self-submitting fingerprint forms, hidden fingerprint fields, and the mode:'php' artifact. 6. Block on shared staging infrastructure and /curl/ paths. 7. Be aware that an apparently benign or look-alike response from a domain does not mean it is safe, as the server decides content per-request. 8. Use the domain naming pattern (word 'file' combined with dictionary terms) as a hunting lead combined with shared infrastructure behavior and fingerprinting gate signals.

Affected products:

macOS (all versions prior to macOS 26.4)
macOS 26.4 (with new Terminal protections released March 24
2026)

Related CVE's:

Related threat actors:

IOC's:

filecopperbasket[.]sbs, applefilevault[.]com, /curl/<id> staging path, Domain naming pattern: 'file' combined with dictionary terms, mode:'php' fingerprint artifact in POST requests, Self-submitting fingerprint forms with hidden fingerprint fields, Outbound HTTP POST requests following archive creation, curl piped into zsh, Base64 decoding activity in Terminal, osascript execution, Archive creation followed by outbound HTTP POST

This article was created with the assistance of AI technology by Perceptive.