macOS ClickFix Campaign Evolves with Fingerprinting Gates

Microsoft Threat Intelligence has identified a significant shift in the tradecraft of macOS ClickFix campaigns. Previously, these campaigns openly served malicious lures on landing pages; however, they have evolved to utilize server-side Traffic Distribution System (TDS) gates. These gates use JavaScript-based fingerprinting to profile visitors, collecting hardware, browser, and environmental attributes—such as WebGL GPU signals and console-tampering checks—to distinguish genuine macOS users from security researchers, crawlers, or sandboxes.

Once a target is qualified, the gate serves a counterfeit 'Download for macOS' page that tricks users into pasting malicious obfuscated commands into the Terminal. This execution flow bypasses traditional macOS application trust paths like Gatekeeper and Notarization. The campaign ultimately delivers high-impact infostealers, including Atomic Stealer (AMOS), MacSync, and SHub Stealer, which are designed to exfiltrate credentials, cryptocurrency wallets, and sensitive browser data.

This evolution marks a transition toward more resilient, anti-analysis infrastructure. Organizations should prioritize user education regarding the dangers of pasting Terminal commands and implement robust monitoring for native macOS utility abuse (e.g., curl, osascript, dscl) initiated shortly after web browsing activity.