A new ClickFix operation targeting macOS uses a clever detour to frustrate security research and automated analysis. Instead of showing everyone the same page with the same instructions, the infrastructure first checks visitors against their environment. Only those who seem “good enough” are shown the lure—tempting them to run a malicious command sequence in Terminal.
Microsoft Security Research tracked this campaign over time and reported how the attack works. The key takeaway: the lure and the malicious chain only activate after ClickFix macOS fingerprinting—a server-side “gate” that decides per visit what a user sees.
What is ClickFix macOS fingerprinting?
With ClickFix, you typically get a page that pretends to offer legitimate software, for example with a “Download for macOS”-style screen. In this campaign, the check happens first: the server collects context signals from the browser to determine whether the visitor is likely a real user—or a crawler, sandbox, or analyst.
Crucially, this decision is made on the server side. That means visiting the exact same URL twice can produce totally different results: a blank page, a misleading variant, or the real “lure.”
Why the gate evades security analysis
Microsoft describes that many front-end domains may look suspicious on their own, but static scanners and sandboxes tend to stumble over the content rather than the true mechanism. In earlier web pages, parts of the ClickFix instructions, clipboard logic, and staging addresses were embedded directly in the HTML. That made it easier for tooling to reconstruct what happened.
In the later variant, that logic is moved: a script (about 2.5 KB of JavaScript) reads navigator values and other properties of the browser or environment. The script then sends a set of signals to the server, which decides which page the visitor receives.
Which signals are measured?
The gate checks, among other things, platform information and screen and window characteristics. It also includes WebGL/graphics signals to distinguish real Apple hardware from virtualization or emulation. Factors such as time zone and whether the page is loaded in an iframe also play a role.
There are also checks that appear specifically designed to trip up researchers:
- A counter that increases when the browser developer console is open.
- A so-called tripwire using canPlayType(“video/mp4”), abused to detect whether a stealth browser is trying to mimic codec support “on its own behalf.”
What real macOS users see
Those who pass through the gate get a fake experience that feels like a legitimate download page. The report notes that the page can have a GitHub-like look and that a fabricated “Verified Publisher” badge is used.
So the gate doesn’t only add delay or camouflage—it provides selective content. Crawlers, sandboxes, or visitors from unexpected contexts may instead:
- receive a blank page,
- see a fake browser extension, or
- land on an unrelated site.
The core action remains: running Terminal
This campaign isn’t only “smart in the browser.” The attack still requires the user to copy a command-line snippet and execute it in Terminal. Microsoft emphasizes that this step is essential.
The command sequence then fetches additional scripts and starts an infostealer chain. The instruction includes a form of obfuscation and ultimately leads to a final component within the analyzed chain.
What data is the infostealer trying to collect?
According to Microsoft, the stealer targets data such as:
- references/credential-like information,
- browser-related data,
- authenticatestore information,
- cryptocurrency wallets, and
- other sensitive files.
Microsoft did not share how many victims were affected, which sectors were targeted, or who the operators are.
From domains to payload: the path and the chain
Microsoft confirmed more than 250 front-end domains during the observation window. Many domain names combine words like “file” with dictionary terms. Examples mentioned in the research include names like filecopperbasket[.]sbs and applefilevault[.]com.
Note: Microsoft states that the domain pattern alone is a weaker signal. The stronger indicator is the combination of:
- shared infrastructure characteristics,
- the recognizable behavior of the fingerprinting gate, and
- the shared staging or activation elements that reappear in the chain.
After successful activation, the command sequence requests a path with /curl/<id>, then downloads follow-up scripts. In the analyzed chain, the operation starts with a component that Microsoft views as part of the broader campaigns.
Why “looks safe” isn’t enough
One standout point from the Microsoft report: an apparently harmless or highly similar response from a domain doesn’t mean the source is safe. Because the server decides differently for each request, one visit can show a fake page while another visit returns the actual lure.
That’s why “just check whether the site installs something” isn’t sufficient. With ClickFix macOS fingerprinting, the malicious behavior can remain hidden from standard tooling.
Detection: what to watch for
For defenders, the focus isn’t only on hunting individual front-end domains, but—above all—on behavior and traces around the gate and the subsequent command chain.
Microsoft advises staying alert to a pattern like: browsing to the lure, followed by unusual Terminal activity.
Concrete indicators in system and network logs
Look for combinations such as:
- curl piped into zsh,
- Base64 decoding,
- executing osascript, and
- creating archives (archive creation) followed by outbound HTTP POST requests.
In addition, you can hunt for artifacts that specifically fit the gate: self-submitting forms with fingerprint fields, hidden fingerprinting inputs, and the presence of a feature such as mode:”php” in the package.
Because server-client logic can vary per visit, it’s often more effective to block based on the shared staging infrastructure and the /curl/ paths, rather than continuing to search every throwaway front-end.
Practical measures for users
The most direct protection remains: don’t follow web instructions that ask you to paste text into Terminal or run a command line. This applies to prompts delivered via a website, a CAPTCHA flow, chat messages, or “download” pages.
Microsoft puts it bluntly: ignore instructions where you copy and run a snippet of code. Be extra alert when a page claims it’s a safe download while still requiring you to manually run commands.
If you want to understand why “fake” redirects and instructions show up so often in infostealer campaigns, read also Passkey-hijack door malware: zo werkt het. You’ll see the same pattern there: the step toward account impact goes through deception and execution on the user’s side.
Why macOS also tries to protect itself
In addition to detection on the defender side, there are OS changes that make users more cautious. In the context of this campaign, it’s mentioned that Apple released macOS 26.4 (in March 2026) and that detailed documentation appeared about additional protections.
Specifically, this includes prompts in Terminal when the tool hasn’t been opened for a longer time, the absence of common developer tools, and signals around copy/paste from browsers or messaging apps.
It’s also mentioned that XProtect can trace commands that get pasted into a terminal emulator, inspect processes in the process tree, and examine network artifacts to block known malware-related activity.
Conclusion: focus on the gate and Terminal behavior
In this campaign, ClickFix macOS fingerprinting isn’t a side detail—it’s the starting point of the deception. The server gate hides the real lure for crawlers and sandboxes and only shows it to selected visitors. As a result, research can be delayed if you only analyze the front-end URLs.
To prepare, it helps to focus on what happens behind the lure: browsing that ends in unusual Terminal steps like curl, Base64 decoding, osascript, and archive creation combined with outbound web traffic. With that focus, you can block more effectively at the shared infrastructure and the /curl/ activation, instead of chasing domains that constantly change.
Finally: treat any instruction that asks you to paste Terminal commands as suspicious. That remains the most practical defense line, regardless of how “legitimate” the page looks.
Source: https://thehackernews.com/2026/08/over-250-clickfix-domains-use-browser.html
