A ClickFix for macOS operation spanning more than 250 domains now uses browser fingerprinting to decide whether to serve visitors a malware decoy. This change was observed by Microsoft Threat Intelligence in infrastructure it had been monitoring for weeks.
See also: SCMBANKER malware uses ClickFix and targets banking users
The server-side gateway hides the malicious page from scanners and sandboxes, while presenting selected Mac users with a fake software download. Microsoft said the wider cluster distributed MacSync and Atomic Stealer (AMOS). The chain analyzed through the gateway led to AMOS.
The attack still requires the user to copy and run a disguised command in Terminal. This command retrieves scripts and launches an infostealer that targets credentials, browser data, credential storage, cryptocurrency wallets, and sensitive files. Microsoft has not disclosed the number of victims, targeted domains, or the identity of the operators. Users should not follow any website, CAPTCHA, chat, or download instructions that ask them to paste text into Terminal.
Microsoft said in an analysis published on August 5 that the infrastructure changed over several weeks of monitoring. Previous pages exposed ClickFix instructions, clipboard logic, a disguised shell command, and a hardcoded staging address directly in their HTML, making them easy for static scanners to retrieve.
The gateway script, about 2.5 KB of JavaScript, reads navigator values such as the platform string, which should report MacIntel on a real Mac, along with screen and window dimensions and WebGL graphics signals that help distinguish genuine Apple hardware from a virtual machine or emulation environment.
It checks the time zone, whether the page is placed inside an iframe, and whether the device reports touch support, which desktop Macs generally don't have. Two detections specifically target analysts: a counter that increments when the browser's developer console is open, and a call to canPlayType(“video/mp4”) that is used as a trap that signals stealth browsers that feign codec support in JavaScript.
The packet is marked with mode:”php” and is sent back without user interaction.
See also: ClickFix: Analysis of 3,000 payloads reveals API-driven malware
The browser sends the fingerprint to the server, which chooses what the visitor sees. A crawler, sandbox, or visitor to an undesired site might receive a blank page, a fake browser extension, or an unrelated business website. A request that looks like a genuine Mac in the expected context receives a “Download for macOS” page with a GitHub theme and a fake “Verified Publisher” badge.
“A seemingly harmless or uniform response does not mean the domain is safe,” Microsoft Security Research and Srinivasan Govindarajan, a senior security researcher at the company, said in the report. The decision is made server-side for each request, so two visits to the same address can produce completely different pages.
Microsoft confirmed more than 250 front-end domains during the monitoring window. Many combine the word “file” with dictionary terms, including filecopperbasket[.]sbs and applefilevault[.]com. The company cautioned that the pattern is only a clue to hunt for. The strongest signal combines consumable names, shared infrastructure behavior, and the fingerprinting gateway.
Once a victim executes the command, it communicates with a /curl/ path
Defenders should watch for browsing followed by unusual Terminal activity, especially curl piped to zsh, Base64 decoding, osascript, and file creation followed by outbound HTTP POST requests.
See also: ClickFix campaigns expand malware distribution with new loaders and fake updates
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Because the malicious page is only displayed to selected visitors, the recommended move is to hunt down the portal instead of the malware behind it: watch for fingerprint auto-submitted forms, hidden fingerprint fields, and the mode:”php” artifact, and block on shared staging infrastructure and /curl/ routes instead of hunting down expendable front-end domains.
