The **ClickFix** operation, which distributes infostealers like **MacSync** and **Atomic Stealer (AMOS)**, now employs a server-side gate that fingerprints visitors before deciding whether to present them with a malware lure. This strategic change aims to evade crawlers and sandboxes, delivering fake software downloads exclusively to targeted Mac users. ### Evolving Evasion Techniques **Microsoft**'s analysis, published on August 5, details how the campaign's infrastructure evolved over several weeks of monitoring. Earlier iterations of the attack exposed **ClickFix** instructions, clipboard logic, obfuscated shell commands, and encoded staging addresses directly within their HTML, making them susceptible to static scanners. With the new gate, a compact 2.5 KB JavaScript bundle collects various `navigator` values. These include the platform string (expecting `MacIntel`), screen and window dimensions, and **WebGL** graphics signals, which collectively help differentiate genuine Apple hardware from virtual machines or emulated environments. ### Advanced Anti-Analysis Measures Beyond basic system checks, the fingerprinting script also scrutinizes the visitor's timezone, detects if the page is nested within an iframe, and checks for touch support—a feature generally absent on desktop Macs. Crucially, it incorporates specific probes to identify security analysts: * A counter that increments when the browser's developer console is open. * A `canPlayType("video/mp4")` call repurposed as a tripwire to flag stealth browsers that might be faking codec support in JavaScript. This collected fingerprint, tagged `mode:"php"`, is then sent to the server without any user interaction. ### Tailored Lures and Payloads Based on the fingerprint, the server determines the content displayed to the visitor. Crawlers, sandboxes, or visitors from unwanted geographical locations might receive a blank page, a fake browser extension, or an unrelated business site. However, a request resembling a genuine Mac within the expected context is served a GitHub-themed "Download for macOS" page, complete with a forged "Verified Publisher" badge.  **Microsoft Security Research** and Senior Security Researcher **Srinivasan Govindarajan** emphasized in their report that "An apparently benign or look-alike response does not mean the domain is safe." The server-side decision-making means that repeated visits to the same URL can yield entirely different pages. ### Campaign Scale and Operator Identity **Microsoft** confirmed over 250 front-end domains involved during its tracking period. Many of these domains combine the word "file" with dictionary terms, such as `filecopperbasket[.]sbs` and `applefilevault[.]com`. However, **Microsoft** cautions that this naming pattern is merely a hunting lead; the stronger indicators are the combination of disposable names, shared infrastructure behavior, and the unique fingerprinting gate. If a victim falls for the lure, they are still required to copy and execute an obfuscated command in Terminal. This command retrieves further scripts and ultimately launches an infostealer, with **AMOS** being the payload observed in the chain **Microsoft** analyzed. The infostealer targets credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files. ### Defensive Strategies and User Guidance Defenders should prioritize monitoring for unusual Terminal activity following web browsing, specifically looking for `curl` piped into `zsh`, `Base64` decoding, `osascript` calls, and archive creation followed by outbound HTTP POST requests. Given the sophisticated nature of the gate, the recommended defense strategy shifts from hunting the malware itself to targeting the gate. Security professionals should watch for self-submitting fingerprint forms, hidden fingerprint fields, and the `mode:"php"` artifact. Blocking shared staging infrastructure and `/curl/` paths is more effective than chasing ephemeral front-end domains. Users are strongly advised never to follow any website, CAPTCHA, chat, or download instruction that prompts them to paste text into Terminal. ### Apple's Protections **Apple** has also introduced protections in **macOS 26.4**, released on March 24, 2026. Terminal now displays a confirmation prompt for users who haven't opened it in over 30 days, lack common developer tools, and are pasting from browsers or messaging apps. Additionally, **XProtect** can trace commands pasted into any terminal emulator, inspect their process tree and network artifacts, and block known malware activity. While **Microsoft**'s report details the infrastructure and mechanisms, it refrains from disclosing the campaign's overall scale or the identity of its operators. The new fingerprinting gate primarily serves as an anti-analysis measure, making it harder for security tools to detect, but the fundamental attack vector—requiring user interaction to execute a command—remains unchanged. Refusing this step continues to be the most effective protection.