Microsoft Threat Intelligence has detailed a macOS ClickFix operation spanning more than 250 front-end domains that fingerprints visitors before deciding whether to show a malware lure. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download, and the analyzed attack chain ended in the Atomic Stealer (AMOS) infostealer.
How the Server-Side Fingerprinting Gate Selects macOS Victims
The roughly 2.5-kilobyte gate script reads navigator values including the platform string, screen and window dimensions, and WebGL signals, then checks timezone, iframe containment, and touch support. Two probes specifically hunt for analysts: a counter for an open developer console, and a canPlayType check on video codecs that flags stealth browsers faking codec support. The script sends a bundle tagged with a “php” mode string with no user interaction required.
Why the Same URL Shows Different Content to Different Visitors
The server decides what each visitor sees. Crawlers and sandboxes receive a blank page, a fake browser extension, or an unrelated business site, while qualifying Macs get a GitHub-themed “Download for macOS” page carrying a forged “Verified Publisher” badge. Microsoft described the effect as two visits to the same address producing entirely different pages, which defeats both automated scanners and manual review by analysts.
The Attack Still Depends on a User Running a Terminal Command
The chain does not end with a download. The victim is still required to copy and run an obfuscated command in Terminal, which retrieves further scripts and launches the infostealer targeting credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files. After the run, the command contacts a path for additional scripts before the AMOS payload executes.
Why the Domain Names Are a Weak Hunting Signal
The domain naming pattern combines “file” with dictionary terms — filecopperbasket[.]sbs and applefilevault[.]com are examples. Microsoft warns that the naming convention is only a hunting lead, and that the stronger signal for defenders is the combination of disposable domains, shared staging infrastructure, and the fingerprinting gate itself. Microsoft did not map every domain to a specific payload.
What the Fingerprinting Gate Says About macOS Infostealer Tactics
The fingerprinting component reads as anti-analysis rather than a change to the attack mechanics. It extends a shift Microsoft documented in May, when macOS infostealer campaigns began using Terminal commands to fetch remote scripts instead of shipping a disk image. Platform hardening has kept pace in some respects: recent macOS releases added Terminal confirmation prompts, and XProtect can trace commands pasted into terminal emulators, but the gate is designed to make sure only a real user on a real Mac ever sees the lure that leads to those commands.
The Wider Cluster: MacSync and the AMOS Payload Line
The cluster that Microsoft tracked distributed two known infostealers — MacSync and Atomic Stealer — and the analyzed chain ended in AMOS, which is a widely available macOS credential stealer. The operation is not tied to a single named group, but the use of the same fingerprinting gate across more than 250 domains points to shared infrastructure rather than a set of independent operators. The obfuscated command that the victim pastes into Terminal is the point at which the attacker-controlled script load begins, and the command retrieval path gives the operator a way to swap payloads after the initial contact.
The Response Path for Defenders
The defensive guidance centers on the infrastructure rather than the throwaway domains: hunt for the fingerprinting gate behavior, including self-submitting fingerprint forms, hidden fingerprint fields, and the php mode string, and block shared staging infrastructure and the command retrieval paths instead of chasing domain names that are replaced as fast as they are burned. For Mac users, the practical rule is that legitimate software is not distributed by pasting commands into Terminal from a web page.
