Full Report
A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download. Microsoft
Analysis Summary
# Tool/Technique: macOS ClickFix (Fingerprinting Variant)
## Overview
ClickFix is a sophisticated social engineering technique that uses "fake error" overlays (often mimicking CAPTCHAs, browser updates, or GitHub pages) to trick users into running malicious commands. This specific evolution utilizes server-side browser fingerprinting via a 2.5 KB JavaScript gate to filter out researchers and sandboxes, delivering macOS-specific malware only to genuine targets.
## Technical Details
- **Type:** Social Engineering Technique / Malware Delivery Framework
- **Platform:** macOS
- **Capabilities:** Anti-analysis (sandbox/crawler detection), environment fingerprinting, credential theft, cryptocurrency draining.
- **First Seen:** Variant documented August 2026 (Infrastructure monitored weeks prior).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise]
- **[TA0002 - Execution]**
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1497.003 - Virtualization/Sandbox Evasion: Time-based Evasion]
- [T1497.001 - Virtualization/Sandbox Evasion: System Checks]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
* **Environment Fingerprinting:** Validates `navigator` values (platform string "MacIntel"), screen/window dimensions, and WebGL signals to ensure the target is a physical Mac.
* **Social Engineering:** Displays a forged GitHub "Download for macOS" page with a fake "Verified Publisher" badge.
* **Terminal Exploitation:** Tricks users into copying and pasting an obfuscated shell command into the macOS Terminal.
* **Dynamic Content Delivery:** The server-side gate (mode:"php") decides per-request whether to serve the malware lure, a blank page, or a benign business site.
### Advanced Features
* **Analyst Tripwires:** Detects if the browser's developer console is open and repurposes `canPlayType("video/mp4")` to identify "stealth" browsers faking codec support.
* **VM/Emulator Detection:** Checks for touch support (rare on desktop Macs) and timezone discrepancies.
* **Encapsulation Detection:** Determines if the malicious page is being loaded inside an iframe (common in sandbox environments).
## Indicators of Compromise
* **Network Indicators (Defanged):**
* applefilevault[.]com
* filecopperbasket[.]sbs
* Staging paths: `*/curl/*`
* **Behavioral Indicators:**
* Unusual Terminal activity: `curl` piped into `zsh`.
* Usage of `Base64` decoding in Terminal.
* Execution of `osascript` following web browsing.
* Unexpected archive creation followed by outbound `HTTP POST` requests.
* JavaScript artifacts containing the string `mode:"php"` in fingerprinting forms.
## Associated Threat Actors
* Identity currently undisclosed; tracked by Microsoft Threat Intelligence.
* Associated with operators distributing infostealer families.
## Detection Methods
* **Behavioral detection:** Monitor for macOS Terminal executions involving network requests (`curl`) immediately following browser activity from non-standard domains.
* **Network detection:** Block known ClickFix staging infrastructure patterns and the specific `/curl/` path used for secondary script retrieval.
* **Web Analysis:** Scan for the 2.5 KB JavaScript fingerprinting gate and hidden form fields tagged with `mode:"php"`.
## Mitigation Strategies
* **User Training:** Educate users never to paste commands from a website into the Terminal.
* **System Hardening:** Update to macOS 26.4+ to leverage Terminal confirmation prompts for suspicious paste actions.
* **Browser Security:** Implement web filtering to block newly registered domains (NRDs) often used in the 250+ domain cluster.
## Related Tools/Techniques
* **Atomic Stealer (AMOS):** The primary infostealer payload delivered in analyzed chains.
* **MacSync:** An alternative macOS infostealer distributed by the same infrastructure.
* **ClearFake:** A similar social engineering framework using fake browser updates.