Key Takeaways
- Microsoft Threat Intelligence observed a macOS‑focused ClickFix campaign that uses a server‑side fingerprinting gate to hide malicious pages from automated scanners while serving a fake macOS download to genuine Apple hardware users.
- The gate runs ~2.5 KB of JavaScript that collects platform, screen, WebGL, timezone, iframe, touch‑support, developer‑console activity, and video‑codec probes to distinguish real Macs from sandboxes or virtual machines.
- Qualified visitors receive a GitHub‑themed “Download for macOS” page that tricks them into copying and executing an obfuscated Terminal command; the command ultimately downloads and launches the Atomic Stealer (AMOS) infostealer (and, in some cases, MacSync).
- The attack still relies on user interaction—pasting and running the command in Terminal—so refusing that step remains the most effective defense.
- Defenders should hunt for the fingerprinting gate (self‑submitting forms, hidden fields, the “mode\":\"php\" artifact, and traffic to /curl/ paths) rather than chasing the constantly rotating front‑end domains, and monitor for anomalous Terminal activity such as curl | zsh, Base64 decoding, osascript use, archive creation, and outbound POSTs.
- Recent macOS protections (confirmation prompts for infrequent Terminal use and XProtect tracing of pasted commands) can mitigate the risk, but user vigilance remains critical.
Overview of the ClickFix Infrastructure Shift
Microsoft Threat Intelligence reported that a macOS‑targeted ClickFix operation, active over several weeks, now employs a sophisticated server‑side gate that fingerprints visitors before deciding what content to display. The gate was identified on more than 250 front‑end domains, many of which combine the word “file” with generic terms (e.g., filecopperbasket[.]sbs, applefilevault[.]com). This change represents a tactical evolution: the malicious lure itself has not changed, but the attackers now hide it from automated analysis tools by serving different pages based on client‑side characteristics.
How the Fingerprinting Gate Works
At the heart of the campaign is a roughly 2.5 KB JavaScript snippet that runs on each request to a compromised domain. The script gathers a variety of browser and device signals: the navigator.platform string (which should read “MacIntel” on authentic Mac hardware), screen and window dimensions, WebGL graphics capabilities, the current timezone, whether the page is loaded inside an iframe, and whether the device reports touch support (a feature typically absent on desktop Macs). Additionally, the script includes two analyst‑focused tripwires—a counter that increments when the browser’s developer console is open, and a call to canPlayType("video/mp4") that is repurposed to detect stealth browsers falsely claiming codec support. All collected data are packaged under the key mode:"php" and sent back to the server without any user interaction.
Server‑Side Decision Making
Upon receiving the fingerprint, the server decides what to return to the visitor. Automated crawlers, sandboxes, or connections originating from unwanted geographic locations may receive a blank page, a fake browser extension, or an unrelated business site—effectively presenting a benign façade. In contrast, a request that matches the profile of a genuine Mac operating in an expected context (correct platform string, appropriate screen size, no touch support, no open developer console, etc.) triggers the delivery of a GitHub‑themed “Download for macOS” page. This page features a forged “Verified Publisher” badge and prominently displays a button or instruction encouraging the user to copy a block of text.
The Malicious Lure and Required User Action
Despite the sophisticated gate, the ultimate payload still depends on the victim manually copying and executing an obfuscated command in the Terminal application. The command, once run, contacts a /curl/ endpoint on the attacker’s infrastructure, retrieves additional scripts, and then launches the Atomic Stealer (AMOS) infostealer. AMOS is designed to harvest a wide range of sensitive data, including saved credentials, browser data, authentication caches, cryptocurrency wallet files, and other personal files. Microsoft noted that the same infrastructure has also been used to distribute MacSync, though not every domain was mapped to a specific payload.
Technical Details of the Payload Delivery Chain
The obfuscated Terminal command typically employs a series of evasion techniques: it may use curl to download a remote script, pipe that output into zsh or bash for execution, embed Base64‑encoded chunks to avoid plain‑text detection, leverage osascript to run AppleScript commands, and create archives (e.g., zip or tar) before exfiltrating stolen data via outbound HTTP POST requests. Because the malicious page only appears for vetted visitors, traditional URL‑based blacklists of front‑end domains are ineffective; the attackers can rotate disposable domain names rapidly while keeping the backend gate and /curl/ paths stable.
Defensive Recommendations
Microsoft advises defenders to focus detection efforts on the fingerprinting gate rather than chasing the ever‑changing front‑end URLs. Indicators of the gate include self‑submitting forms, hidden form fields that transmit the fingerprint, and the presence of the mode:"php" artifact in network traffic. Monitoring for requests to the shared staging infrastructure and to /curl/ paths can help identify compromised domains regardless of their surface‑level names. On the endpoint side, security teams should watch for anomalous Terminal activity: instances where a user pastes text from a browser or messaging app into Terminal, followed by curl commands piped into zsh or bash, Base64 decoding steps, osascript invocations, archive creation, and unexpected outbound HTTP POSTs.
Built‑in macOS Mitigations
Recent macOS updates provide additional layers of protection. Starting with macOS 26.4 (released March 24, 2026), Apple introduced a confirmation prompt that appears when Terminal is launched by a user who has not opened the application in more than 30 days, lacks common developer tools, and attempts to paste content sourced from a browser or messaging app. This prompt forces the user to explicitly approve the paste action, thereby adding a friction point that can thwart automated or socially engineered paste‑and‑run attacks. Separately, XProtect now has the capability to trace commands pasted into any terminal emulator, inspect the resulting process tree and network artifacts, and block activity that matches known malware signatures. While these controls reduce risk, they do not replace the need for user awareness and vigilant monitoring.
Context Within Broader macOS Threat Trends
The observed ClickFix gate extends a trend Microsoft first highlighted in May 2024, when macOS‑targeted infostealer campaigns began shifting from delivering malicious disk images to relying on remote‑script retrieval via Terminal commands. By moving the payload delivery to a dynamic, server‑side gate, attackers increase the difficulty for automated analysis while preserving the core social‑engineering element: convincing a user to paste and run a command. The gate essentially functions as a “visibility filter” that keeps the malicious infrastructure hidden from scanners and sandboxes, but does not alter the fundamental requirement for user interaction. Consequently, the most reliable defense remains refusing to execute any unsolicited Terminal command, regardless of how benign the preceding web page may appear.
Conclusion
The macOS ClickFix operation described by Microsoft illustrates a growing sophistication in threat actor tactics: a combination of client‑side fingerprinting, server‑side content gating, and persistent reliance on user‑driven Terminal execution to deploy stealers like AMOS. Although the attackers have added layers to evade detection, the core mitigation strategy stays the same—educate users to never paste unverified code into Terminal, monitor for the telltale signs of the fingerprinting gate, and leverage built‑in macOS protections that add verification steps to risky paste actions. By focusing on the stable gate infrastructure and the anomalous Terminal behaviors it produces, organizations can maintain effective visibility and response capabilities against this evolving threat.