Executive Summary
Microsoft Threat Intelligence has identified an evolution in the macOS ClickFix campaign, attributed to Storm-2945 (a sub-cluster of Midnight Blizzard). The threat actor has transitioned from open lure pages to using a server-side Traffic Distribution System (TDS) that employs browser fingerprinting to qualify victims. By profiling visitors' hardware, browser attributes, and potential instrumentation, the campaign hides malicious lures from researchers, crawlers, and automated sandboxes, displaying them only to genuine macOS users.
The attack chain relies on social engineering to trick users into copying and pasting obfuscated Terminal commands. This technique bypasses traditional macOS application security controls like Gatekeeper and notarization. Once executed, the commands retrieve multi-stage scripts that ultimately deploy information stealers such as Atomic Stealer (AMOS) or MacSync to harvest credentials, cryptocurrency wallets, and sensitive browser data.
This activity represents a significant increase in tradecraft sophistication for macOS-focused threats. The use of large-scale, algorithmically generated domains and cloaking mechanisms necessitates a shift in detection strategy from static domain blocking to behavior-based monitoring of Terminal activity and environmental profiling artifacts.