Threat reportMalwareTL-2026-1899
Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign
Over 250 ClickFix Domains Use Browser Fingerprinting to Hide (TL-2026-1899), also tracked as ClickFix macOS Infostealer Campaign (August 2026), is a high-severity malware campaign, first published 2026-08-05 and last reviewed 2026-08-06. It has no confirmed attribution, affects Apple macOS, maps to 37 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 88 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 37MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 88Indicators of compromise
Key facts for TL-2026-1899
- Threat ID
- TL-2026-1899
- Also known as
- ClickFix macOS Infostealer Campaign (August 2026), Microsoft macOS ClickFix TDS Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- all sectors untargeted campaign
- Target regions
- Global (primarily English-speaking users)
- Detection rules
- 9
- Indicators of compromise
- 88
- Updates
- 2026-08-06 · revalidated 1× · latest source
Malware and tooling in Over 250 ClickFix Domains Use Browser Fingerprinting to Hide
Malware and tooling: AMOS, curl, ditto, osascript, screencapture, zsh
How Over 250 ClickFix Domains Use Browser Fingerprinting to Hide works
Active macOS ClickFix campaign tracked by Microsoft Threat Intelligence across 250+ front-end domains using server-side browser fingerprinting (WebGL GPU signals, navigator checks, DevTools counters, canPlayType tripwire) to gate the distribution of Atomic Stealer (AMOS) and MacSync infostealers. The fingerprinting gate evaluates environment signals server-side via a Traffic Distribution System (TDS), serving the ClickFix lure only to genuine macOS browsers while returning blank pages, fake browser extensions, or decoy business sites to crawlers, sandboxes, and non-macOS visitors.
On August 5, 2026, Microsoft Threat Intelligence published an analysis of a significant escalation in macOS ClickFix infostealer campaigns: over 250 front-end domains actively distributing Atomic Stealer (AMOS) and MacSync via a server-side browser fingerprinting gate. This campaign represents a material evolution from earlier openly-served ClickFix lures previously documented by Microsoft in May 2026, moving to a Traffic Distribution System (TDS) that evaluates each visitor's browser environment server-side before serving the malicious payload.
The fingerprinting gate (~2.5 KB of JavaScript) collects six browser objects: navigator, screen, window, document, location, and console. Signals include platform (checking for "MacIntel"), WebGL GPU rendering details (to distinguish real Apple hardware from virtualized, emulated, or software-rendered environments), screen dimensions, timezone offset, iframe detection, touch-input support, a DevTools enumeration counter (a toString() function that increments when dev tools or log-capturing serializes it), and a canPlayType("video/mp4") prototype-tamper probe that flags instrumented environments. The fingerprint object is tagged mode:"php" and submitted server-side with zero user interaction.
Server-side evaluation branches into four response categories: (1) genuine macOS browser in expected context receives a GitHub-themed "Download for macOS" page with a forged "Verified Publisher" badge containing an obfuscated curl one-liner; (2) Windows browser visitor receives a decoy — a fake "Urban VPN Proxy" landing page or impersonated logistics/freight-forwarding company site; (3) bot/crawler/sandbox/VM receives a blank page or no content; (4) unwanted geographic locations receive benign decoy content. Two visits to the same domain can produce entirely different pages.
Domains follow observed naming patterns — file<word><word>.tld (filecopperbasket.sbs, filevelvettractor.sbs), <word>file<word>.tld (applefilevault.com, bananafastfile.com), and tokens without the "file" keyword (cloudsendhub.com, syncdatavault.com). Microsoft warns the naming pattern is only a hunting lead; the stronger detection signal combines disposable names, shared infrastructure behavior (the /curl/<id> staging paths), and the fingerprinting gate.
Two distinct malware families are distributed through this campaign. Atomic Stealer (AMOS) is an information stealer targeting credentials, browser data, cryptocurrency wallets, authentication stores, and sensitive files — retrieved via the /curl/<id> path after the victim executes the initial command. The AMOS infection chain (documented by SANS ISC Diary #33208 on July 31, 2026) involves a multi-stage zsh/Mach-O chain with C2 beaconing to 188.166.78[.]138 over HTTP port 80, exfiltrating data across six distinct collection stages (messengers, credentials, browsers, wallets, resolve_auth, local_data). MacSync is a more advanced malware-as-a-service (MaaS) infostealer with a full remote access trojan (RAT) component — the successor to Mac.c Stealer (first appearing April 2024, rebranded as MacSync shortly after). Huntress Research published a comprehensive six-stage reverse engineering analysis documenting MacSync's capabilities: a polymorphic in-memory zsh loader never touching disk, a dynamic AppleScript (~46 KB) executed entirely server-side and served per-request, a native C++ Mach-O RAT (statically linked OpenSSL 3.6.2, ad-hoc signed) with full interactive shell via forkpty over AES-256-CBC WebSocket C2, a separately signed Screen Recording capture agent for TCC-farming, and a wallet app trojanization stage that rewrites installed Ledger and Trezor applications with fake seed-recovery flows.
Persistence mechanisms for MacSync include LaunchAgent plists impersonating legitimate updaters (Google Keystone, Adobe ARM, Microsoft AutoUpdate, OneDrive, Dropbox, Spotify, Grammarly, JetBrains Toolbox) and hidden dot-prefixed directories under ~/Library/Application Support/ mimicking Apple system paths (com.apple.accountsd, com.apple.metadata.mds). AMOS establishes persistence via Mach-O binaries dropped to ~/Library/Application Support/.com.apple.accountsd/AccountsHelper and .com.apple.metadata.mds/mdworker_shared.
No specific threat actor or APT group has been attributed to this campaign. Microsoft has not disclosed victim numbers or targeted sectors. Source code comments in MacSync are in Russian. The campaign is exclusively environment-based targeting without geographic, sector, or persona discrimination, suggesting a financially motivated criminal operation operating as Malware-as-a-Service. Apple mitigated this delivery vector in macOS 26.4 (March 24, 2026) by adding Terminal confirmation prompts that warn users before pasting potentially malicious commands from browsers or messaging applications, with XProtect providing additional runtime behavioral blocking.
MITRE ATT&CK techniques used in TL-2026-1899
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1113 Screen Capture; T1560.001 Archive Collected Data: Archive via Utility
Command and Control
T1008 Fallback Channels; T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1564.001 Hide Artifacts: Hidden Files and Directories
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
T1056.002 Input Capture: GUI Input Capture; T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials in Files; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Web Browsers
Execution
T1059.002 Command and Scripting Interpreter: AppleScript; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.007 Command and Scripting Interpreter: JavaScript; T1106 Native API; T1204.002 User Execution: Malicious File
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1217 Browser Information Discovery; T1518 Software Discovery
Persistence
T1543.001 Create or Modify System Process: Launch Agent; T1543.004 Create or Modify System Process: Launch Daemon; T1547 Boot or Logon Autostart Execution
defense-impairment
T1553.002 Subvert Trust Controls: Code Signing
Initial Access
T1566.002 Phishing: Spearphishing Link
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1588.001 Obtain Capabilities: Malware; T1608.001 Stage Capabilities: Upload Malware
Reconnaissance
Affected products and versions in Over 250 ClickFix Domains Use Browser Fingerprinting to Hide
Remediation for Over 250 ClickFix Domains Use Browser Fingerprinting to Hide
Patches
- Upgrade managed macOS endpoints to version 26.4 or later
Immediate actions
- Block known /curl/ staging URL paths and shared back-end infrastructure at network perimeter
- Deploy endpoint detection rules for curl piped into zsh with base64-decoded URLs
- Enforce macOS 26.4+ Terminal paste warnings via MDM policy
- Monitor for self-submitting fingerprint forms with mode:php tag and hidden fingerprint fields
Workarounds
- Restrict Terminal usage to authorized users with MDM policy
- Block outbound HTTP/HTTPS from curl to low-reputation or newly-registered domains
- Audit and remove suspicious LaunchAgent plists with RunAtLoad and KeepAlive flags pointing to ~/.local/ binaries
Longer-term hardening
- Implement behavioral detections for osascript execution after web browsing activity
- Deploy advanced hunting queries monitoring for LaunchAgent plists impersonating known updater labels with ad-hoc signed binaries
- Monitor for unauthorized keychain access, Chrome Safe Storage key extraction, and Browser Login Data file reads
- Implement detection for ditto/capture followed by HTTP POST exfiltration within short time windows
Timeline of Over 250 ClickFix Domains Use Browser Fingerprinting to Hide
Showing the 20 most recent tracked events.
- Microsoft publishes first ClickFix analysis: 'Think before you Click(Fix) — Analyzing the ClickFix social engineering technique'
- Microsoft Tech Community publishes 'Hunting Infostealers — macOS Threats', detailing AMOS, MacSync, and Shub Stealer delivery chains, persistence mechanisms, and C2 infrastructure.
- Sophos publishes 'Atomic macOS Stealer leads sensitive data theft on macOS', detailing expanded crypto wallet targeting and exfiltration methods.
- MacSync wallet seed-phrase drop domains (sdhomeinspectors.com, southcarolinacounselor.com) re-registered via Unstoppable Domains for use in the MacSync campaign
- Trend Micro publishes an MDR analysis of the AMOS Stealer campaign, documenting cracked-app delivery vectors and the multi-stage infection chain.
- Darktrace publishes an investigation of AMOS as a growing macOS threat, detailing C2 communication patterns and behavioral detection signatures.
- Sophos publishes 'Evil evolution: ClickFix and macOS infostealers' detailing the technique's evolution targeting macOS
- New AMOS variant observed with custom decryption routine, anti-VM evasion via system_profiler checks, hardware crypto wallet trojanization, and resilient persistence
- Apple releases macOS 26.4 with Terminal confirmation prompts warning users before pasting commands from browsers or messaging apps, and improved XProtect behavioral blocking
- Jamf Threat Labs publishes analysis of a ClickFix macOS Script Editor variant delivering AMOS, documenting an additional execution vector via Script Editor.
- Malwarebytes reports ClickFix finding new ways to infect Macs, documenting expansion of lure techniques and infrastructure.
- Microsoft reports ClickFix campaign using fake macOS utilities lures to deliver AMOS, MacSync, and Shub Stealer via Terminal commands instead of .dmg files — a key tactic shift bypassing Gatekeeper
- CTI Pilot publishes an ATT&CK mapping for the expanded ClickFix macOS campaign, documenting cross-campaign TTP analysis.
- MacSync Mach-O RAT binary compiled (build tree at /tmp); statically linked OpenSSL 3.6.2 + Brotli, ad-hoc signed with no Team ID
- Netskope publishes analysis of macOS ClickFix lures deploying AppleScript stealer and persistent RAT with multi-stage infection chain
- Pcap AI publishes 'Atomic macOS Stealer (AMOS): Reading the C2 Protocol from a PCAP' detailing AMOS C2 communication protocol
- Huntress publishes comprehensive six-stage MacSync reverse engineering report detailing in-memory zsh loader, server-side AppleScript, C++ RAT with WebSocket C2, TCC-farming capture helper, and wallet trojanization
- SANS ISC publishes Diary #33208 documenting hands-on AMOS infection analysis with full IOC set including domains (getmacouscloud.com, macostruecloud.xyz, render65.com, grove-89.com), IP 188.166.78.138 C2 server, and five file hashes
- Microsoft Threat Intelligence publishes analysis of 250+ ClickFix domains using server-side browser fingerprinting TDS to gate AMOS and MacSync distribution — a significant escalation from the May 2026 campaign
- Cyber Security News reports on the 250+ macOS ClickFix domains with browser fingerprinting gate, broadening public awareness of the evolved campaign infrastructure.
Update history for TL-2026-1899
- 2026-08-06 — ClickFix Campaign Delivering Atomic Stealer (AMOS) via 250+ macOS Look-Alike Domains with Browser Fingerprinting: What changed No severity/exploitability/status escalation — still HIGH/ACTIVE. Confirmed as the same August 2026 Microsoft 250+-domain ClickFix TDS campaign, now documented with additional AMOS-specific C2 infrastructure, a third malware va
Sources cited for Over 250 ClickFix Domains Use Browser Fingerprinting to Hide
- Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
- Microsoft Security Blog: macOS ClickFix campaign learned to hide behind browser fingerprinting
- Microsoft Security Blog: ClickFix campaign uses fake macOS utilities lures to deliver infostealers
- SANS ISC Diary #33208: Detailed AMOS infection analysis with full IOCs
- Huntress: Reverse Engineering the Six Stages of MacSync
- Sophos: Evil evolution — ClickFix and macOS infostealers
- Netskope: macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT
- Pcap AI: Atomic macOS Stealer (AMOS) — Reading the C2 Protocol from a PCAP
- Microsoft Security Blog: Think before you Click(Fix) — Analyzing the ClickFix social engineering technique
- CloudSEK: Inside MacSync's Script-Driven Stealer and Hardware Wallet App Trojanization
- CSO Online: MacSync Stealer Malware Bypasses macOS Gatekeeper Security Warnings
- Breakglass Intelligence: AMOS Three-Tier C2 Infrastructure Analysis
Detection coverage for TL-2026-1899
As of 2026-08-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1899 across Splunk SPL, Microsoft KQL and Sigma, covering 88 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1899
7 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.