A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks.
The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download. Microsoft said the wider cluster distributed MacSync and Atomic Stealer (AMOS); the chain it analyzed through the gate ended in AMOS.
The attack still requires the user to copy and run an obfuscated command in Terminal. That command retrieves scripts and launches an infostealer targeting credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files. Microsoft has not disclosed victim numbers, targeted sectors, or the identity of the operators.
Users should not follow any website, CAPTCHA, chat, or download instruction that asks them to paste text into Terminal.
Microsoft said in an analysis published August 5 that the infrastructure changed during several weeks of monitoring. Earlier pages exposed the ClickFix instructions, clipboard logic, obfuscated shell command, and encoded staging address directly in their HTML, making them easy for static scanners to recover.
The gate’s script, about 2.5 KB of JavaScript, reads navigator values such as the platform string, which should report MacIntel on a real Mac, along with screen and window dimensions and WebGL graphics signals that help separate genuine Apple hardware from a virtual machine or an emulated environment.
It checks the timezone, whether the page is boxed inside an iframe, and whether the device reports touch support, which desktop Macs generally do not. Two probes specifically hunt for analysts: a counter that ticks up when the browser’s developer console is open, and a call to canPlayType(“video/mp4″) repurposed as a tripwire that flags stealth browsers faking codec support in JavaScript. The bundle is tagged mode:”php” and sent back with no user interaction.
The browser sends the fingerprint to the server, which chooses what the visitor sees. A crawler, sandbox, or visitor in an unwanted location may receive a blank page, fake browser extension, or unrelated business site. A request resembling a genuine Mac in the expected context receives a GitHub-themed “Download for macOS” page with a forged “Verified Publisher” badge.
“An apparently benign or look-alike response does not mean the domain is safe,” Microsoft Security Research and Srinivasan Govindarajan, a senior security researcher at the company, said in the report. The decision happens server-side for each request, so two visits to the same address can produce entirely different pages.
Microsoft confirmed more than 250 front-end domains during its tracking window. Many combine the word “file” with dictionary terms, including filecopperbasket[.]sbs and applefilevault[.]com. The company warned that the pattern is only a hunting lead. The stronger signal combines disposable names, shared infrastructure behavior, and the fingerprinting gate.
Once a victim runs the command, it contacts a /curl/
Defenders should monitor for browsing followed by unusual Terminal activity, especially curl piped into zsh, Base64 decoding, osascript, and archive creation followed by outbound HTTP POST requests.
Because the malicious page only appears for qualified visitors, the recommended move is to hunt the gate rather than the malware behind it: watch for self-submitting fingerprint forms, hidden fingerprint fields, and the mode:”php” artifact, and block on the shared staging infrastructure and /curl/ paths instead of chasing throwaway front-end domains.
Apple released macOS 26.4 on March 24, 2026, and documented the protections in detail on August 3. Terminal shows a confirmation prompt for users who have not opened it in more than 30 days, lack common developer tools, and paste from browsers or messaging apps. Separately, XProtect can trace commands pasted into any terminal emulator, inspect their process tree and network artifacts, and block activity associated with known malware.
The report maps the infrastructure and the mechanism, but not the scale of the campaign or who is running it, both of which Microsoft leaves undisclosed. On the evidence presented, the gate reads as a measure against automated analysis rather than a change to the attack itself: it hides the infrastructure from crawlers and sandboxes, while the lure served to a qualifying Mac and the requirement that the user paste and run the command are unchanged. Refusing that step is as protective as it was before.
The operation extends a shift Microsoft documented in May, when macOS infostealer campaigns began using Terminal commands to fetch remote scripts instead of shipping a disk image to install by hand.
