Actor Profile

ClickFix is a macOS-focused social engineering campaign tracked by Microsoft Threat Intelligence. The operators remain unidentified, but the campaign demonstrates sophisticated evasion capabilities through server-side browser fingerprinting across more than 250 front-end domains. The campaign's motivation centers on credential theft and financial gain, distributing MacSync and Atomic Stealer (AMOS) infostealers that target browser data, authentication stores, cryptocurrency wallets, and sensitive files. The campaign represents an evolution in macOS threat delivery, moving from static disk images to dynamic, gated Terminal command execution.

TTPs (Tactics, Techniques, Procedures)

The campaign employs T1204.003 (User Execution: Malicious Image) through fake software download pages with forged "Verified Publisher" badges. Initial access relies on T1189 (Drive-by Compromise) via over 250 disposable domains using patterns like "file" combined with dictionary terms. T1497.001 (Virtualization/Sandbox Evasion) is implemented through sophisticated JavaScript fingerprinting that checks navigator.platform for MacIntel, screen dimensions, WebGL signals, timezone, iframe context, touch support, developer console detection, and codec support probes. T1059.004 (Command and Scripting Interpreter: Unix Shell) delivers obfuscated commands executed in Terminal, which retrieve staging scripts via curl piped to zsh. T1027 (Obfuscated Files or Information) and T1132.001 (Data Encoding: Standard Encoding) are used with Base64-encoded payloads. The campaign deploys T1555 (Credentials from Password Stores) and T1539 (Steal Web Session Cookie) through AMOS infostealer, targeting browser data, authentication stores, and cryptocurrency wallets. Exfiltration occurs via T1041 (Exfiltration Over C2 Channel) through HTTP POST requests to /curl/ paths on staging infrastructure.

Targets & Patterns

The campaign targets macOS users in the technology sector, though Microsoft has not disclosed specific victim numbers or geographic distribution. The selective targeting mechanism uses browser fingerprinting to identify genuine Mac hardware (MacIntel platform, desktop screen dimensions, no touch support) while filtering out crawlers, sandboxes, virtual machines, and security researchers. The server-side gate ensures that only qualified visitors matching the desired profile receive malicious lures, while others see blank pages, fake browser extensions, or legitimate-looking business sites. The focus on macOS users with cryptocurrency wallets and stored credentials suggests financially motivated targeting of technology professionals and organizations with valuable digital assets.

Historical Context

This campaign extends a shift Microsoft documented in May 2026, when macOS infostealer operations began using Terminal commands to fetch remote scripts instead of distributing disk images for manual installation. The current infrastructure represents an evolution Microsoft tracked over several weeks, transitioning from static HTML pages that exposed ClickFix instructions, clipboard logic, and staging addresses directly in source code to dynamic server-side fingerprinting gates. Earlier iterations were easily detected by static scanners; the fingerprinting mechanism represents a defensive adaptation against automated analysis. The campaign continues to distribute known macOS infostealers MacSync and AMOS, maintaining payload consistency while evolving delivery infrastructure. Apple responded with macOS 26.4 (released March 24, 2026, documented August 3) introducing Terminal confirmation prompts for infrequent users pasting from browsers and XProtect enhancements to trace pasted commands and inspect process trees.

Defensive Recommendations

  • Monitor for browsing activity immediately followed by Terminal execution, specifically curl piped to zsh (T1059.004), Base64 decoding operations, osascript invocations, and archive creation followed by outbound HTTP POST requests
  • Hunt for the fingerprinting gate rather than front-end domains: detect self-submitting forms with hidden fingerprint fields, the mode:"php" artifact in POST requests, and JavaScript that probes navigator.platform, WebGL, developer console state, and canPlayType codec checks
  • Block network connections to /curl/ URI paths and shared staging infrastructure rather than chasing disposable front-end domains following the "file" + dictionary term pattern
  • Implement user awareness training emphasizing that legitimate websites, CAPTCHAs, downloads, and chat applications never require users to paste commands into Terminal, and enforce policies prohibiting this behavior
  • Deploy macOS 26.4 or later to leverage Terminal confirmation prompts for paste operations from browsers and messaging apps, and ensure XProtect signatures are current to detect AMOS and MacSync infostealer process trees and network artifacts