# Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign

> Active macOS ClickFix campaign tracked by Microsoft Threat Intelligence across 250+ front-end domains using server-side browser fingerprinting (WebGL GPU signals, navigator checks, DevTools counters, canPlayType tripwire) to gate the distribution of Atomic Stealer (AMOS) and MacSync infostealers. The fingerprinting gate evaluates environment signals server-side via a Traffic Distribution System (TDS), serving the ClickFix lure only to genuine macOS browsers while returning blank pages, fake browser extensions, or decoy business sites to crawlers, sandboxes, and non-macOS visitors.

- **Published:** 2026-08-05T00:00:00Z
- **Last reviewed:** 2026-08-06T05:55:20.708Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1899
- **ID:** TL-2026-1899
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 88 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On August 5, 2026, Microsoft Threat Intelligence published an analysis of a significant escalation in macOS ClickFix infostealer campaigns: over 250 front-end domains actively distributing Atomic Stealer (AMOS) and MacSync via a server-side browser fingerprinting gate. This campaign represents a material evolution from earlier openly-served ClickFix lures previously documented by Microsoft in May 2026, moving to a Traffic Distribution System (TDS) that evaluates each visitor's browser environment server-side before serving the malicious payload.

The fingerprinting gate (~2.5 KB of JavaScript) collects six browser objects: navigator, screen, window, document, location, and console. Signals include platform (checking for "MacIntel"), WebGL GPU rendering details (to distinguish real Apple hardware from virtualized, emulated, or software-rendered environments), screen dimensions, timezone offset, iframe detection, touch-input support, a DevTools enumeration counter (a toString() function that increments when dev tools or log-capturing serializes it), and a canPlayType("video/mp4") prototype-tamper probe that flags instrumented environments. The fingerprint object is tagged mode:"php" and submitted server-side with zero user interaction.

Server-side evaluation branches into four response categories: (1) genuine macOS browser in expected context receives a GitHub-themed "Download for macOS" page with a forged "Verified Publisher" badge containing an obfuscated curl one-liner; (2) Windows browser visitor receives a decoy — a fake "Urban VPN Proxy" landing page or impersonated logistics/freight-forwarding company site; (3) bot/crawler/sandbox/VM receives a blank page or no content; (4) unwanted geographic locations receive benign decoy content. Two visits to the same domain can produce entirely different pages.

Domains follow observed naming patterns — file<word><word>.tld (filecopperbasket.sbs, filevelvettractor.sbs), <word>file<word>.tld (applefilevault.com, bananafastfile.com), and tokens without the "file" keyword (cloudsendhub.com, syncdatavault.com). Microsoft warns the naming pattern is only a hunting lead; the stronger detection signal combines disposable names, shared infrastructure behavior (the /curl/<id> staging paths), and the fingerprinting gate.

Two distinct malware families are distributed through this campaign. Atomic Stealer (AMOS) is an information stealer targeting credentials, browser data, cryptocurrency wallets, authentication stores, and sensitive files — retrieved via the /curl/<id> path after the victim executes the initial command. The AMOS infection chain (documented by SANS ISC Diary #33208 on July 31, 2026) involves a multi-stage zsh/Mach-O chain with C2 beaconing to 188.166.78[.]138 over HTTP port 80, exfiltrating data across six distinct collection stages (messengers, credentials, browsers, wallets, resolve_auth, local_data). MacSync is a more advanced malware-as-a-service (MaaS) infostealer with a full remote access trojan (RAT) component — the successor to Mac.c Stealer (first appearing April 2024, rebranded as MacSync shortly after). Huntress Research published a comprehensive six-stage reverse engineering analysis documenting MacSync's capabilities: a polymorphic in-memory zsh loader never touching disk, a dynamic AppleScript (~46 KB) executed entirely server-side and served per-request, a native C++ Mach-O RAT (statically linked OpenSSL 3.6.2, ad-hoc signed) with full interactive shell via forkpty over AES-256-CBC WebSocket C2, a separately signed Screen Recording capture agent for TCC-farming, and a wallet app trojanization stage that rewrites installed Ledger and Trezor applications with fake seed-recovery flows.

Persistence mechanisms for MacSync include LaunchAgent plists impersonating legitimate updaters (Google Keystone, Adobe ARM, Microsoft AutoUpdate, OneDrive, Dropbox, Spotify, Grammarly, JetBrains Toolbox) and hidden dot-prefixed directories under ~/Library/Application Support/ mimicking Apple system paths (com.apple.accountsd, com.apple.metadata.mds). AMOS establishes persistence via Mach-O binaries dropped to ~/Library/Application Support/.com.apple.accountsd/AccountsHelper and .com.apple.metadata.mds/mdworker_shared.

No specific threat actor or APT group has been attributed to this campaign. Microsoft has not disclosed victim numbers or targeted sectors. Source code comments in MacSync are in Russian. The campaign is exclusively environment-based targeting without geographic, sector, or persona discrimination, suggesting a financially motivated criminal operation operating as Malware-as-a-Service. Apple mitigated this delivery vector in macOS 26.4 (March 24, 2026) by adding Terminal confirmation prompts that warn users before pasting potentially malicious commands from browsers or messaging applications, with XProtect providing additional runtime behavioral blocking.

## MITRE ATT&CK

- T1566.002 Phishing: Spearphishing Link
- T1204.002 User Execution: Malicious File
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.002 Command and Scripting Interpreter: AppleScript
- T1106 Native API
- T1543.001 Create or Modify System Process: Launch Agent
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1553.002 Subvert Trust Controls: Code Signing
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1070.004 Indicator Removal: File Deletion
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1555.001 Credentials from Password Stores: Keychain
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.002 Input Capture: GUI Input Capture
- T1552.001 Unsecured Credentials: Credentials in Files
- T1082 System Information Discovery
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1560.001 Archive Collected Data: Archive via Utility
- T1113 Screen Capture
- T1071.001 Application Layer Protocol: Web Protocols
- T1592 Gather Victim Host Information
- T1583.001 Acquire Infrastructure: Domains
- T1588.001 Obtain Capabilities: Malware
- T1608.001 Stage Capabilities: Upload Malware
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1543.004 Create or Modify System Process: Launch Daemon
- T1547 Boot or Logon Autostart Execution
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1105 Ingress Tool Transfer
- T1008 Fallback Channels
- T1041 Exfiltration Over C2 Channel

## Sources

- [Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures](https://thehackernews.com/2026/08/over-250-clickfix-domains-use-browser.html)
- [Microsoft Security Blog: macOS ClickFix campaign learned to hide behind browser fingerprinting](https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/)
- [Microsoft Security Blog: ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [SANS ISC Diary #33208: Detailed AMOS infection analysis with full IOCs](https://isc.sans.edu/diary/33208)
- [Huntress: Reverse Engineering the Six Stages of MacSync](https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering)
- [Sophos: Evil evolution — ClickFix and macOS infostealers](https://www.sophos.com/en-us/security-research/malware/clickfix-and-macos-infostealers)
- [Netskope: macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT](https://www.netskope.com/blog/macos-clickfix-lures-deploy-applescript-stealer-persistent-rat)
- [Pcap AI: Atomic macOS Stealer (AMOS) — Reading the C2 Protocol from a PCAP](https://www.pcapsecurity.com/research/atomic-macos-stealer-amos-c2-protocol)
- [Microsoft Security Blog: Think before you Click(Fix) — Analyzing the ClickFix social engineering technique](https://www.microsoft.com/en-us/security/blog/2025/08/05/think-before-you-clickfix)
- [CloudSEK: Inside MacSync's Script-Driven Stealer and Hardware Wallet App Trojanization](https://www.cloudsek.com/blog/inside-macsyncs-script-driven-stealer-and-hardware-wallet-app-trojanization)
- [CSO Online: MacSync Stealer Malware Bypasses macOS Gatekeeper Security Warnings](https://www.csoonline.com/article/4111179/macsync-stealer-malware-bypasses-macos-gatekeeper-security-warnings.html)
- [Breakglass Intelligence: AMOS Three-Tier C2 Infrastructure Analysis](https://breakglass.io/research/amos-c2-architecture)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1899