Do Son 
At a glance
| Malware family | Atomic Stealer (AMOS) and MacSync infostealers |
| Threat actor | Unnamed operator running a Traffic Distribution System (attribution not stated) |
| Target or victims | Genuine macOS users in expected browser contexts |
| Delivery vector | Cloaked ClickFix pages across 250+ look-alike domains |
| Key capabilities | Browser fingerprinting, anti-analysis checks, credential and wallet theft |
| Source | Microsoft Threat Intelligence |
TL;DR
Microsoft Threat Intelligence tracked a macOS ClickFix campaign that hides its lure behind a server-side fingerprinting gate. The gate profiles each visitor and shows the fake download page only to real Mac users. Researchers and sandboxes get a blank or decoy page instead.
What changed in this macOS ClickFix campaign
ClickFix tricks users into pasting a command into Terminal. The lure poses as a fake update, download error, or CAPTCHA step. Because the command runs by hand, it can skip parts of the normal macOS trust path.
The delivery method stayed the same. However, the operators added a new filter in front of it. As Microsoft explains, the infrastructure moved “from openly serving the malicious command” to “concealing the lure behind a server-side fingerprinting gate.”
Why this matters
The gate limits who sees the attack. Crawlers, sandboxes, and analysts often receive harmless content. Meanwhile, real macOS visitors still get the poisoned command.
Delivery: hundreds of look-alike domains
Microsoft confirmed more than 250 ClickFix front-end domains during the tracking window. Many share a naming pattern that combines the word “file” with dictionary terms. Examples include filecopperbasket, fileoceanhammer, and filemarblegarden.
Some domains move the “file” token around or drop it entirely. Therefore defenders should treat the naming pattern as a hunting pivot, not a full signature. The stronger signal combines these domains with shared behavior and the fingerprinting gate.
Infection chain: from gated lure to AMOS
A qualifying visitor sees a counterfeit “Download for macOS” page. It shows a forged “Verified Publisher” badge and a one-click copy button. The button copies an obfuscated curl command into the clipboard.
When the victim runs that command, the chain fetches a remote script. Several script stages follow. Finally, the campaign installs Atomic Stealer, also known as AMOS. Some samples deliver MacSync instead.
AMOS then harvests credentials, browser data, and cryptocurrency wallet files. After collection, it exfiltrates the stolen data. The GitHub-style branding on the lure is spoofed and does not mean GitHub was breached.
The browser fingerprinting gate
Instead of showing the lure at once, each domain returns a tiny profiling script of about 2.5 KB. To a casual visitor, the page may look blank or parked. In reality, it decides who deserves the payload.
What the gate checks
First, the script reads browser identity from objects like navigator and screen. It captures the platform value, such as “MacIntel,” plus display size and pixel ratio. These signals suggest whether the device is a real, non-virtualized Mac.
Next, it uses WebGL to read GPU details. Those graphics signals help separate real Apple hardware from emulated or sandboxed systems. The gate also checks timezone, touch support, and whether the page runs inside an iframe.
Anti-analysis tripwires
Two checks stand out. One is a toString() counter that rises when a developer console serializes output. Another repurposes an MP4 codec check as a tripwire for faked browser behavior. Together they flag researcher and automation environments.
Command-and-control and victim selection
Once profiling finishes, the client sends the fingerprint back to the server. The server then picks one of two responses. Bots, crawlers, and virtual machines get a blank page or a benign decoy.
By contrast, a genuine Mac in an expected context receives the ClickFix lure. Microsoft calls this a Traffic Distribution System, “because the payload is delivered by server-side, on demand, only to visitors the operator selects.” As a result, automated analysis often sees nothing malicious.
Defense and detection guidance
First, inspect page content without running client-side JavaScript. That lets defenders observe the gate logic directly. The gate is often a more reliable hunting target than the downstream malware.
Next, correlate several signals rather than one. Useful clues include self-submitting fingerprint forms, hidden data fields, and the mode:”php” artifact. The “file” naming convention adds context. Microsoft’s full write-up on this macOS ClickFix campaign that learned to hide lists more hunting pivots.
Finally, warn users never to paste Terminal commands from a download page. A “Verified Publisher” badge in a browser proves nothing. Indicators of compromise here stay descriptive on purpose.
The bottom line
This macOS ClickFix campaign shows how attackers borrow anti-bot tricks to dodge analysis. The techniques are not new, but their use in a ClickFix flow is notable. Environment-based targeting keeps the lure in front of victims and out of the lab.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
