250+ ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware

Microsoft Threat Intelligence has tracked a macOS ClickFix operation spanning more than 250 front-end domains that fingerprints visitors before serving a malware lure, hiding the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download. The wider cluster distributes MacSync and Atomic Stealer (AMOS), with the gated chain Microsoft analyzed ending in AMOS, an infostealer targeting credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files. The attack still requires the user to copy and run an obfuscated shell command in Terminal.

The server-side gate replaced earlier static pages that exposed ClickFix instructions, clipboard logic, obfuscated commands, and encoded staging addresses directly in their HTML. The new gate relies on roughly 2.5 KB of JavaScript that reads navigator values such as the platform string (which should report "MacIntel" on a real Mac), along with screen and window dimensions and WebGL graphics signals that help separate genuine Apple hardware from a VM or emulated environment. It also checks the timezone, whether the page is loaded inside an iframe, touch support (which desktop Macs generally do not report), and two anti-analysis probes: a counter that ticks up when the developer console is open, and a canPlayType("video/mp4") call repurposed as a tripwire that flags stealth browsers faking codec support. Researchers can audit how their own browser appears to sites using a browser fingerprint test.

The fingerprint bundle is tagged mode:"php" and sent back to the server with no user interaction, where the operator decides what each visitor sees. Crawlers, sandboxes, and visitors in unwanted locations may receive a blank page, a fake browser extension, or an unrelated business site. A request resembling a genuine Mac in the expected context receives a GitHub-themed "Download for macOS" page complete with a forged "Verified Publisher" badge. "An apparently benign or look-alike response does not mean the domain is safe," wrote Microsoft Security Research and senior security researcher Srinivasan Govindarajan in the August 5 analysis. Many of the 250+ domains combine the word "file" with dictionary terms, including filecopperbasket[.]sbs and applefilevault[.]com; visitors who encounter such names should run a WHOIS lookup to check registration history and ownership. Users are urged to harden their exposure with a privacy checkup and to never paste text into Terminal at the instruction of a website, CAPTCHA, chat window, or download prompt, since the AMOS chain still depends on manual execution of the obfuscated command to succeed.