Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate — Threadlinqs Intelligence
As of 2026-08-06, Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 42 indicators of compromise.
Threat ID: TL-2026-1907 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
A sophisticated macOS ClickFix campaign deploys over 250 algorithmically generated fake download domains distributing AMOS (Atomic macOS Stealer) and MacSync infostealers. The operation is
Microsoft Threat Intelligence tracked an extensive macOS infostealer campaign operating through a cluster of more than 250 algorithmically generated fake download domains. The campaign's defining evolution is a server-side browser-fingerprinting gate — approximately 2.5 KB of JavaScript — that profiles every visitor before deciding whether to serve the malicious payload. The gate collects data from six browser objects (navigator, screen, window, document, location, console), uses WebGL GPU signals to distinguish real Apple hardware from virtualized, emulated, or sandboxed environments, checks timezone offset for geographic plausibility, detects iframe embedding (associated with crawlers), and probes for touch support (uncommon on desktop macOS). Two anti-analysis probes are included: a toString() counter that increments when DevTools or headless log-capturing tools serialize console output, and a repurposed canPlayType('video/mp4') call that serves as a tripwire for stealth browsers faking codec support via hooked JavaScript prototypes. The collected fingerprint, tagged with mode:'php', is silently submitted to the server via a self-submitting form. The server then makes a per-request decision: qualified macOS targets receive a counterfeit GitHub-themed 'Download for macOS' page with a forged 'Verified Publisher' badge offering a one-click 'Copy' button for an obfuscated curl one-liner; all other visitors receive decoy content such as a fake Urban VPN Proxy browser extension landing page, a fake VPN landing page, or pages impersonating an unrelated logistics company. The decoy responses mean that 'an apparently benign or look-alike response does not mean the domain is safe,' as Microsoft noted. The infection chain requires the victim to paste and run the obfuscated Terminal command, which retrieves a remote script from /curl/<id> staging URLs, chains through multiple script stages (using curl, base64, gunzip, chmod, osascript, and xattr), and ultimately delivers either AMOS or MacSync infostealer. AMOS performs comprehensive data theft targeting browser credentials, cryptocurrency wallets, Keychain entries, authentication stores, and sensitive files, exfiltrating via HTTP POST. MacSync employs a more sophisticated six-stage chain documented by Huntress and Sophos: a thin polymorphic zsh loader, a server-side daemon function that fetches in-memory AppleScript via an API-key-gated endpoint, a dynamic AppleScript stealer (~46 KB) that obtains Full Disk Access via social engineering, validates captured passwords against dscl . authonly, and steals Chromium Safe Storage keys, Gecko browser profiles, desktop cryptocurrency wallets, Telegram data, keychain databases, SSH keys, AWS credentials, and Kubernetes configs — all staged under /tmp/sync<random>/ and archived via ditto. A C++ Mach-O RAT (statically linked, OpenSSL 3.6.2, universal x86_64+arm64) is then deployed as a persistent LaunchAgent, communicating over WebSocket over TLS to a bare IP (85.206.161.241:8443) with AES-256-CBC encryption. The RAT supports full interactive shell via forkpty, file upload/download, screen capture (delegated to a separately signed helper app named 'Screen Recording' to obtain TCC approval), and self-removal on server command. Finally, a Stage 6 payload trojanizes installed Ledger Wallet, Ledger Live, and Trezor Suite applications by swapping in patched app.asar files that inject a seed-phrase phishing flow, exfiltrating the BIP39 recovery phrase to attacker-controlled seed drop domains. The infrastructure comprises three tiers: Cloudflare-fronted delivery domains (agenticsora.com, malwareaudit.com, and 250+ file<word><word> domains), a bare-IP TLS-based RAT C2 (85.206.161.241:8443), and seed drop domains (sdhomeinspectors.com, southcarolinacounselor.com) receiving stolen recovery phrases. The shared api-key (9dd465d26c7d86b4a6f514a4b46b2295), shared /curl endpoint, and byte-identical loaders across multiple front domains tie all activity to a sin
Target sectors: technology, cryptocurrency, finance, individuals
Target regions: North America, 005 - South America, Europe, india, belgium
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 42 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
7 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.002, T1059.004, T1059.002, T1204.001, T1106, T1543.001, T1647, T1554, T1027, T1140
