MacOS ClickFix Operation Expands to 250 Domains, Uses Browser Fingerprinting

A macOS ClickFix operation spanning over 250 front-end domains now uses browser fingerprinting to decide whether to show users a malware lure, according to Microsoft Threat Intelligence.

The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download. The wider cluster distributed MacSync and Atomic Stealer (AMOS), with the chain analyzed by Microsoft ending in AMOS.

Although the attack still requires users to copy and run an obfuscated command in Terminal, Microsoft has noted that the malicious page only appears for qualified visitors who pass the fingerprinting test. This means defenders should monitor for browsing followed by unusual Terminal activity, especially curl piped into zsh, Base64 decoding, osascript, and archive creation followed by outbound HTTP POST requests.