Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign — Threadlinqs Intelligence
As of 2026-08-06, Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 88 indicators of compromise.
Threat ID: TL-2026-1899 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Updated: 2026-08-06 · revalidated 1× · latest source
Active macOS ClickFix campaign tracked by Microsoft Threat Intelligence across 250+ front-end domains using server-side browser fingerprinting (WebGL GPU signals, navigator checks, DevTools counters,
On August 5, 2026, Microsoft Threat Intelligence published an analysis of a significant escalation in macOS ClickFix infostealer campaigns: over 250 front-end domains actively distributing Atomic Stealer (AMOS) and MacSync via a server-side browser fingerprinting gate. This campaign represents a material evolution from earlier openly-served ClickFix lures previously documented by Microsoft in May 2026, moving to a Traffic Distribution System (TDS) that evaluates each visitor's browser environment server-side before serving the malicious payload.
The fingerprinting gate (~2.5 KB of JavaScript) collects six browser objects: navigator, screen, window, document, location, and console. Signals include platform (checking for "MacIntel"), WebGL GPU rendering details (to distinguish real Apple hardware from virtualized, emulated, or software-rendered environments), screen dimensions, timezone offset, iframe detection, touch-input support, a DevTools enumeration counter (a toString() function that increments when dev tools or log-capturing serializes it), and a canPlayType("video/mp4") prototype-tamper probe that flags instrumented environments. The fingerprint object is tagged mode:"php" and submitted server-side with zero user interaction.
Server-side evaluation branches into four response categories: (1) genuine macOS browser in expected context receives a GitHub-themed "Download for macOS" page with a forged "Verified Publisher" badge containing an obfuscated curl one-liner; (2) Windows browser visitor receives a decoy — a fake "Urban VPN Proxy" landing page or impersonated logistics/freight-forwarding company site; (3) bot/crawler/sandbox/VM receives a blank page or no content; (4) unwanted geographic locations receive benign decoy content. Two visits to the same domain can produce entirely different pages.
Domains follow observed naming patterns — file<word><word>.tld (filecopperbasket.sbs, filevelvettractor.sbs), <word>file<word>.tld (applefilevault.com, bananafastfile.com), and tokens without the "file" keyword (cloudsendhub.com, syncdatavault.com). Microsoft warns the naming pattern is only a hunting lead; the stronger detection signal combines disposable names, shared infrastructure behavior (the /curl/<id> staging paths), and the fingerprinting gate.
Two distinct malware families are distributed through this campaign. Atomic Stealer (AMOS) is an information stealer targeting credentials, browser data, cryptocurrency wallets, authentication stores, and sensitive files — retrieved via the /curl/<id> path after the victim executes the initial command. The AMOS infection chain (documented by SANS ISC Diary #33208 on July 31, 2026) involves a multi-stage zsh/Mach-O chain with C2 beaconing to 188.166.78[.]138 over HTTP port 80, exfiltrating data across six distinct collection stages (messengers, credentials, browsers, wallets, resolve_auth, local_data). MacSync is a more advanced malware-as-a-service (MaaS) infostealer with a full remote access trojan (RAT) component — the successor to Mac.c Stealer (first appearing April 2024, rebranded as MacSync shortly after). Huntress Research published a comprehensive six-stage reverse engineering analysis documenting MacSync's capabilities: a polymorphic in-memory zsh loader never touching disk, a dynamic AppleScript (~46 KB) executed entirely server-side and served per-request, a native C++ Mach-O RAT (statically linked OpenSSL 3.6.2, ad-hoc signed) with full interactive shell via forkpty over AES-256-CBC WebSocket C2, a separately signed Screen Recording capture agent for TCC-farming, and a wallet app trojanization stage that rewrites installed Ledger and Trezor applications with fake seed-recovery flows.
Persistence mechanisms for MacSync include LaunchAgent plists impersonating legitimate updaters (Google Keystone, Adobe ARM, Microsoft AutoUpdate, OneDrive, Dropbox, Spotify, Grammarly, JetBrains Toolbox) and hidden dot-prefixed directories under ~/Library/Application Support/ mimic
Target sectors: all sectors untargeted campaign
Target regions: Global (primarily English-speaking users)
Detections & IOCs
As of 2026-08-23, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 88 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
7 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.002, T1204.002, T1059.004, T1059.002, T1106, T1543.001, T1027, T1140, T1036.005, T1553.002
