The discovery of more than 250 domains supporting a macOS-focused ClickFix campaign demonstrates how attackers are improving the infrastructure surrounding social-engineering attacks rather than changing the basic deception that makes them successful. The campaign continues to convince users to copy and execute malicious commands in Terminal, but it now uses browser fingerprinting and server-side filtering to ensure that the dangerous instructions are shown primarily to suitable victims. Automated scanners, security researchers and visitors who do not match the attacker’s preferred profile may receive an empty page, a harmless business website or an unrelated browser-extension advertisement, making the malicious infrastructure considerably more difficult to identify and block. 

ClickFix attacks do not normally exploit a software vulnerability. They create a convincing browser message claiming that the user must complete a verification process, fix a technical problem, install an application or update existing software. The page places a command into the clipboard and instructs the victim to open the Windows Run dialog or macOS Terminal, paste the command and execute it. Because the user performs the final action manually, the malicious command runs with the permissions and access available to that user. The technique is effective because it disguises command execution as a routine troubleshooting or installation step rather than presenting an obvious executable download.

In the campaign analysed by Microsoft, the attackers introduced a fingerprinting gate before displaying the macOS lure. A small JavaScript component collected information about the visitor’s browser and device and sent the resulting profile to the server without requiring any interaction. The server then decided what content should be returned. This decision was made separately for every request, meaning two visitors opening the same domain could receive entirely different pages. A security crawler might conclude that the address was harmless, while a genuine Mac user visiting minutes later could be shown a fake software download designed to initiate malware installation.

The fingerprinting code checked whether the browser identified the platform as `MacIntel`, a value commonly associated with genuine macOS systems. It also examined screen and window dimensions, timezone, touch support and WebGL graphics information. These details can help distinguish physical Apple hardware from virtual machines, emulators and automated browser environments. Desktop Macs generally do not report touch-screen support, while virtual analysis environments may expose unusual graphics configurations, screen dimensions or browser characteristics that reveal their artificial nature.

The script also looked for indicators that a security analyst was inspecting the page. One mechanism attempted to detect whether the browser’s developer console was open, while another used browser media-capability behaviour as a tripwire for stealth browsers and automated tools that imitate normal browser functions imperfectly. The page checked whether it had been embedded inside an iframe, a technique sometimes used by security products to analyse content safely. By combining multiple weak indicators rather than depending on one test, the attackers could reduce the probability that the malicious page would be exposed to automated scanning.

This form of selective delivery creates a significant challenge for web-filtering and threat-intelligence systems. Traditional scanners may visit a suspicious domain once, receive an ordinary page and classify the site as safe. The domain can therefore remain active even while delivering malware to visitors who meet the server’s targeting requirements. Repeated visits may also produce different results depending on the source address, location, browser environment and device profile. An apparently harmless response should not therefore be treated as conclusive evidence that the domain is safe.

When the server identified a suitable macOS visitor, it displayed a GitHub-themed page offering a supposed software download for macOS. The page included professional branding and a forged “Verified Publisher” badge intended to reassure the victim that the software was legitimate. This is an important social-engineering element because many users associate GitHub with trusted development projects and open-source software. The attackers borrowed that reputation without needing to compromise GitHub itself, using visual familiarity to lower the victim’s suspicion before presenting the Terminal instructions.

The malicious page did not simply deliver a traditional application installer. Instead, it instructed the user to copy an obfuscated command and paste it into Terminal. Once executed, the command contacted a remote path containing `/curl/` and an identifier, downloaded additional scripts and continued the infection process. In the chain analysed by Microsoft, the final payload was Atomic Stealer, also known as AMOS. The wider infrastructure was also associated with the delivery of MacSync, although researchers did not link every identified domain to one specific malware family.

Atomic Stealer is designed to collect valuable information from compromised Macs, including browser data, stored credentials, authentication information, cryptocurrency-wallet details and sensitive files. Depending on the malware configuration and the applications installed on the system, it may access passwords, cookies, session data and local information that can support further account compromise. The theft of authenticated browser sessions is particularly dangerous because an attacker may be able to access cloud services without entering the victim’s password or completing the original multi-factor authentication process again.

MacSync similarly operates as a macOS information stealer and may target credentials, browser information, authentication stores and other sensitive data. The use of different payloads through the same domain cluster suggests that the infrastructure may function as a flexible delivery platform rather than one campaign permanently tied to a single malware family. Attackers can change the final payload while retaining the same fingerprinting, filtering and social-engineering mechanisms. This allows them to adapt the operation according to availability, customer demand or the type of victim being targeted.

Microsoft confirmed more than 250 front-end domains during its monitoring period. Many combined the word “file” with ordinary dictionary terms or technology-related words, producing names that appeared plausible enough to avoid immediate suspicion. Some domains were clearly designed to evoke Apple services or software-download platforms. However, naming patterns alone are not reliable indicators because attackers can register new domains rapidly and abandon old ones as soon as they are blocked. Defenders should treat the pattern as a useful hunting lead rather than a permanent detection rule.

The stronger indicators are the shared infrastructure and behaviour surrounding the domains. Security teams should look for pages that automatically collect browser fingerprints, submit hidden form fields and contain artifacts associated with the server-side gating mechanism. They should also monitor requests to characteristic `/curl/` paths and identify browsing activity followed shortly by unusual Terminal commands. Attackers can replace the visible domain names easily, but changing the complete delivery architecture requires more effort and may create recurring behavioural signals.

The campaign demonstrates why browser security and endpoint security must be correlated. The initial deception occurs inside the browser, but the compromise begins when the victim switches to Terminal and executes the copied command. A browser-security product may see the suspicious page but not the later shell activity, while an endpoint product may observe `curl`, `zsh` or `osascript` without knowing which website persuaded the user to run them. Connecting browser history, clipboard activity, process execution and network events can reveal the complete attack sequence.

Defenders should monitor for browser activity followed by Terminal commands involving `curl` piped directly into `zsh` or another shell. Base64 decoding, use of `osascript`, archive creation and outbound HTTP POST requests may indicate later stages of the infection. A newly launched Terminal process that downloads and executes remote content immediately after visiting an unfamiliar software page deserves urgent investigation. Shell commands that conceal their destination through encoding or string manipulation should receive additional scrutiny, especially when the user is not a developer or administrator who normally performs such actions.

Organizations should also consider whether ordinary users require unrestricted access to Terminal and command-line download utilities. Completely disabling Terminal may not be practical in technical environments, but application controls and endpoint policies can limit execution for users whose job functions do not require it. Security products should alert when Terminal is launched by unusual workflows or when commands are pasted from a browser or messaging application. The objective is not to block every legitimate shell command but to identify the sequence that makes ClickFix attacks distinctive.

Apple has introduced protections intended to make browser-to-Terminal attacks more visible. On supported macOS versions, Terminal may display a confirmation warning when users who do not regularly use the application paste commands originating from browsers or messaging tools. XProtect can also trace pasted commands, inspect related processes and network activity, and block behaviour associated with known malware. These measures can disrupt recognised attack chains, but they cannot protect users who ignore the warning or encounter infrastructure and commands that have not yet been classified.

Security awareness therefore remains important, although training must address the specific behaviour rather than relying on generic advice about suspicious links. Employees should understand that legitimate websites, CAPTCHA systems, support portals and software vendors should not ask them to paste unexplained commands into Terminal. A command can install malware regardless of whether the page labels it as verification, repair or software installation. Users should obtain applications from the official vendor website, the Mac App Store or an approved organizational software catalogue rather than following instructions displayed on an unexpected page.

The campaign also demonstrates how attackers exploit the reputation of software-development platforms. A GitHub-themed page may appear credible to technical users because downloading open-source applications and scripts from repositories is normal. Developers, administrators and power users may also be more comfortable with Terminal commands and less likely to consider the instructions inherently suspicious. This can make technically skilled users particularly valuable targets because their systems may contain cloud credentials, source-code access, SSH keys, API tokens and privileged sessions.

Organizations should treat developer Macs and administrative workstations as privileged assets. Access tokens and production credentials should not remain continuously available to every local process. Secrets should be stored through managed credential systems, short-lived tokens and hardware-backed authentication wherever possible. Browser sessions for sensitive platforms should be protected with device-based access policies so that stolen cookies cannot be replayed easily from attacker-controlled systems.

Conditional Access and device-compliance policies can reduce the value of stolen browser sessions by requiring access to sensitive cloud services from approved devices. Services should also require fresh authentication for high-risk actions such as registering authentication methods, creating API tokens or changing account recovery details. Password rotation alone may not remove an attacker who has stolen cookies or refresh tokens, so incident response must include session revocation and review of connected applications.

Any Mac on which a suspicious ClickFix command was executed should be isolated and treated as potentially compromised. The investigation should determine which command was pasted, what infrastructure it contacted and which scripts or files were created. Security teams should examine shell history, Terminal process activity, downloads, Launch Agents, login items, browser extensions and unusual outbound connections. The absence of a visible application in the Applications folder does not prove that the system is clean because the command may execute scripts directly or install persistence in user-controlled directories.

Responders should review browser databases, authentication stores and cryptocurrency applications that may have been accessible to the malware. Cloud sessions should be revoked, and passwords and tokens should be changed from a trusted device after the infected Mac has been contained. Cryptocurrency wallets may need to be moved to new keys generated on a clean system if wallet credentials or seed information could have been exposed. Where the full behaviour of the downloaded scripts cannot be established, rebuilding the Mac from a trusted image provides greater assurance than attempting to remove a few identified files.

The use of server-side fingerprinting also means that incident responders should not rely solely on opening a reported link from their own analysis environment. The domain may show benign content when visited from a Windows device, virtual machine, automated browser or different region. Investigators should preserve the original browser and network telemetry from the victim’s endpoint and inspect downloaded page content, DNS records, proxy logs and command history. Controlled testing may require replicating the victim’s environment, although analysts should avoid executing the delivered commands outside an isolated research system.

Threat-intelligence teams should focus on infrastructure relationships rather than treating all 250 domains as a fixed blocklist. Front-end domains are disposable and can be replaced quickly. Shared staging servers, characteristic URL paths, certificate relationships, hosting patterns and fingerprinting scripts may provide longer-lived indicators. DNS and proxy data can be used to identify other domains communicating with the same infrastructure or exhibiting similar behaviour.

The broader cybersecurity lesson is that ClickFix has become an established malware-delivery model rather than a temporary phishing trick. Its success comes from transferring the final execution step to the victim. The browser page does not need to exploit macOS when it can persuade the user to run the command willingly. Endpoint security may see a legitimate Terminal process, while network tools see standard HTTPS traffic. The attack hides between these trusted components and depends on the user connecting them.

The fingerprinting gate makes the campaign more difficult to study and disrupt, but it does not change the fundamental weakness on which the attack depends. The malware still requires the victim to paste and execute an untrusted command. Refusing that instruction stops the infection before the stealer is downloaded, regardless of how convincing the website appears or how effectively the infrastructure hides from security scanners.

Organizations should therefore combine technical controls with one clear behavioural rule: no website, CAPTCHA, chat message or software-download page should instruct users to paste unknown commands into Terminal. When a page makes that request, the user is no longer merely downloading software. They are granting the website permission to decide what their computer executes.

The more than 250 domains identified by Microsoft demonstrate the scale and organization behind this technique. The attackers are investing in fingerprinting, infrastructure rotation, selective delivery and multiple malware payloads because the approach continues to work. Defenders must respond by monitoring the complete path from browser interaction to command execution, restricting unnecessary shell access and ensuring that employees recognise the moment when a harmless-looking webpage attempts to become an administrator of their Mac.

A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download. Microsoft

Source: Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures via The Hacker News — published 05 Aug 2026.