Threat reportMalwareTL-2026-1907

Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate

highACTIVE

Over 250 Fake Download Domains Deliver AMOS and MacSync (TL-2026-1907), also tracked as ClickFix macOS fingerprinting campaign, is a high-severity malware campaign, first published 2026-08-06. It has no confirmed attribution, affects Apple macOS, maps to 25 MITRE ATT&CK techniques (T1027, T1033, T1036), and is covered by 9 detection rules and 42 indicators of compromise.

Severity
HIGHAssessed severity
CVEs
0None referenced
Techniques
25MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
42Indicators of compromise

Key facts for TL-2026-1907

Threat ID
TL-2026-1907
Also known as
ClickFix macOS fingerprinting campaign, file<word><word> ClickFix domain cluster
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
Last reviewed
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, cryptocurrency, finance, individuals
Target regions
North America, 005 - South America, Europe, india, belgium
Detection rules
9
Indicators of compromise
42

Malware and tooling in Over 250 Fake Download Domains Deliver AMOS and MacSync

Malware and tooling: AMOS

How Over 250 Fake Download Domains Deliver AMOS and MacSync works

A sophisticated macOS ClickFix campaign deploys over 250 algorithmically generated fake download domains distributing AMOS (Atomic macOS Stealer) and MacSync infostealers. The operation is distinguished by a ~2.5 KB server-side browser-fingerprinting JavaScript gate that profiles visitors across navigator, screen, WebGL GPU, timezone, and anti-analysis probes before conditionally serving malicious payloads — only genuine macOS targets receive the ClickFix lure, while sandboxes, scanners, crawlers, and non-macOS visitors see decoy pages or blank content. This represents a significant TTP escalation from prior ClickFix operations that served the malicious command directly in HTML source.

Microsoft Threat Intelligence tracked an extensive macOS infostealer campaign operating through a cluster of more than 250 algorithmically generated fake download domains. The campaign's defining evolution is a server-side browser-fingerprinting gate — approximately 2.5 KB of JavaScript — that profiles every visitor before deciding whether to serve the malicious payload. The gate collects data from six browser objects (navigator, screen, window, document, location, console), uses WebGL GPU signals to distinguish real Apple hardware from virtualized, emulated, or sandboxed environments, checks timezone offset for geographic plausibility, detects iframe embedding (associated with crawlers), and probes for touch support (uncommon on desktop macOS). Two anti-analysis probes are included: a toString() counter that increments when DevTools or headless log-capturing tools serialize console output, and a repurposed canPlayType('video/mp4') call that serves as a tripwire for stealth browsers faking codec support via hooked JavaScript prototypes. The collected fingerprint, tagged with mode:'php', is silently submitted to the server via a self-submitting form. The server then makes a per-request decision: qualified macOS targets receive a counterfeit GitHub-themed 'Download for macOS' page with a forged 'Verified Publisher' badge offering a one-click 'Copy' button for an obfuscated curl one-liner; all other visitors receive decoy content such as a fake Urban VPN Proxy browser extension landing page, a fake VPN landing page, or pages impersonating an unrelated logistics company. The decoy responses mean that 'an apparently benign or look-alike response does not mean the domain is safe,' as Microsoft noted. The infection chain requires the victim to paste and run the obfuscated Terminal command, which retrieves a remote script from /curl/<id> staging URLs, chains through multiple script stages (using curl, base64, gunzip, chmod, osascript, and xattr), and ultimately delivers either AMOS or MacSync infostealer. AMOS performs comprehensive data theft targeting browser credentials, cryptocurrency wallets, Keychain entries, authentication stores, and sensitive files, exfiltrating via HTTP POST. MacSync employs a more sophisticated six-stage chain documented by Huntress and Sophos: a thin polymorphic zsh loader, a server-side daemon function that fetches in-memory AppleScript via an API-key-gated endpoint, a dynamic AppleScript stealer (~46 KB) that obtains Full Disk Access via social engineering, validates captured passwords against dscl . authonly, and steals Chromium Safe Storage keys, Gecko browser profiles, desktop cryptocurrency wallets, Telegram data, keychain databases, SSH keys, AWS credentials, and Kubernetes configs — all staged under /tmp/sync<random>/ and archived via ditto. A C++ Mach-O RAT (statically linked, OpenSSL 3.6.2, universal x86_64+arm64) is then deployed as a persistent LaunchAgent, communicating over WebSocket over TLS to a bare IP (85.206.161.241:8443) with AES-256-CBC encryption. The RAT supports full interactive shell via forkpty, file upload/download, screen capture (delegated to a separately signed helper app named 'Screen Recording' to obtain TCC approval), and self-removal on server command. Finally, a Stage 6 payload trojanizes installed Ledger Wallet, Ledger Live, and Trezor Suite applications by swapping in patched app.asar files that inject a seed-phrase phishing flow, exfiltrating the BIP39 recovery phrase to attacker-controlled seed drop domains. The infrastructure comprises three tiers: Cloudflare-fronted delivery domains (agenticsora.com, malwareaudit.com, and 250+ file<word><word> domains), a bare-IP TLS-based RAT C2 (85.206.161.241:8443), and seed drop domains (sdhomeinspectors.com, southcarolinacounselor.com) receiving stolen recovery phrases. The shared api-key (9dd465d26c7d86b4a6f514a4b46b2295), shared /curl endpoint, and byte-identical loaders across multiple front domains tie all activity to a single operator. Russian-language comments in the malware source code (including 'ВСТАВЬТЕ СЮДА' for 'INSERT HERE' and 'Убрана хрупкая SafeSQLiteCopy' noting a Firefox crash fix) and a CIS-keyboard-layout kill switch in the loader campaign suggest a Russian-speaking operator. No specific named threat actor or nation-state has been attributed. Active infection clusters were observed across Belgium, India, and parts of North and South America. Apple introduced a mitigation in macOS 26.4+ (March 24, 2026) that blocks pasting potentially malicious commands into Terminal with a 'Possible malware, Paste blocked' warning, and XProtect signatures have been updated. The campaign infrastructure evolved from Phase 1 (open — malicious command present in HTML source, easy for static scanners to recover) to Phase 2 (cloaked — server-side fingerprinting gate, payload hidden from automated analysis), representing a significant anti-analysis evolution in macOS infostealer operations.

MITRE ATT&CK techniques used in TL-2026-1907

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564.001 Hidden Files and Directories

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery; T1497.001 System Checks

Credential Access

T1056.002 GUI Input Capture; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.001 Keychain; T1555.003 Credentials from Web Browsers

Execution

T1059.002 AppleScript; T1059.004 Unix Shell; T1106 Native API; T1204.001 Malicious Link

Persistence

T1543.001 Launch Agent; T1554 Compromise Host Software Binary

privilege-escalation

T1548 Abuse Elevation Control Mechanism

defense-impairment

T1553.002 Code Signing; T1647 Plist File Modification; T1685 Disable or Modify Tools

Initial Access

T1566.002 Spearphishing Link

Affected products and versions in Over 250 Fake Download Domains Deliver AMOS and MacSync

  • Apple — macOS
    Vulnerable versions: All versions prior to 26.4
    Fixed in: 26.4+ (Terminal paste-blocking mitigation, XProtect signatures)
  • Google — Chrome
    Vulnerable versions: All versions (browser data targeted by infostealer)
  • Mozilla — Firefox
    Vulnerable versions: All versions (browser data targeted by infostealer)
  • Ledger — Ledger Live / Ledger Wallet
    Vulnerable versions: All versions (trojanized via app.asar replacement)
  • Trezor — Trezor Suite
    Vulnerable versions: All versions (trojanized via app.asar replacement)

Remediation for Over 250 Fake Download Domains Deliver AMOS and MacSync

Patches

  • Apply macOS 26.4+ update which includes Terminal paste-blocking mitigation for ClickFix commands
  • Ensure XProtect definitions are up to date
  • Keep Microsoft Defender for Endpoint antivirus signatures current

Immediate actions

  • Block known malicious domains at network perimeter and DNS layer
  • Block known C2 IPs (85.206.161.241, 103.216.221.95, 45.94.47.204) and exfiltration IPs
  • Deploy EDR rules to detect curl|zsh, curl|osascript, and base64 decode in Terminal
  • Alert on outbound HTTP POST to /curl/, /gate/, /dynamic endpoints from macOS endpoints
  • Block known seed drop domains (sdhomeinspectors.com, southcarolinacounselor.com)

Workarounds

  • Educate users: never paste Terminal commands from websites, CAPTCHAs, or download instructions
  • Restrict use of curl piped to shell interpreters via endpoint detection rules
  • Consider application allowlisting to prevent unauthorized Mach-O binary execution
  • Disable or restrict unsigned/ad-hoc codesigned application execution where possible

Longer-term hardening

  • Implement behavioral detection for browser fingerprinting scripts with mode:php parameter
  • Monitor for Terminal sessions with curl piped to shell immediately after browser activity
  • Deploy DNS sinkholing for algorithmically generated domains matching file<word><word> patterns
  • Implement detection for ad-hoc code-signed Mach-O binaries with no Team ID
  • Monitor for unauthorized access to ~/Library/Keychains/ and security dump-generic-password commands
  • Deploy hunt queries for staged archives in /tmp/ being uploaded via HTTP PUT/POST
  • Implement TCC anomaly detection — repeated prompts for Full Disk Access, Screen Recording, or Accessibility

Timeline of Over 250 Fake Download Domains Deliver AMOS and MacSync

  • Microsoft first documented the ClickFix technique targeting macOS users in a blog post urging users to 'Think before you Click(Fix),' establishing the baseline social-engineering pattern later refined by this campaign.
  • Sophos observed the first of three ClickFix campaigns distributing MacSync via Google sponsored search ads, using the OpenAI Atlas browser as bait with fake sites hosted on sites.google.com — the first documented use of malvertising for MacSync delivery.
  • Sophos observed a second malvertising campaign using sponsored ChatGPT search links with redirects through shared ChatGPT conversations funneling victims to fake GitHub-themed landing pages. Tracking infrastructure recorded approximately 29,180 clicks across the campaign lifecycle.
  • Cluster of MacSync delivery domains registered around December 20, 2025, including get-mactech.com, getmaclab.com, getmacnow.com, imaclife.com, insta-macer.com, and related domains documented by Sophos.
  • Sophos observed a third wave of MacSync attacks featuring a new variant with a multistage loader-as-a-service model, API key-gated C2 infrastructure, dynamic AppleScript payloads, and aggressive in-memory execution — representing a significant architectural evolution from earlier native MachO builds.
  • Seed drop domains sdhomeinspectors.com and southcarolinacounselor.com registered through Unstoppable Domains behind Cloudflare, sharing privacy-redacted WHOIS with delivery domains.
  • Sophos X-Ops published 'Evil evolution: ClickFix and macOS infostealers' detailing the three-campaign progression, MacSync multistage loader architecture, geographic targeting (Belgium, India, North and South America), and Ledger wallet trojanization.
  • Apple released macOS 26.4 which introduced a Terminal paste-blocking mitigation: 'Possible malware, Paste blocked' warning appears when users paste potentially malicious commands into Terminal from browsers or messaging apps. XProtect signatures updated to detect ClickFix command chains.
  • Microsoft published detailed analysis of the ClickFix campaign using fake macOS utilities lures, documenting the Loader, Script, and Helper campaign variants, 67 Loader C2 domains, CIS keyboard layout kill switch, and wallet trojanization of Ledger, Trezor, and Exodus applications.
  • Netskope published analysis of macOS ClickFix campaign deploying AppleScript-based stealer and RAT payloads, documenting the continued evolution of the delivery chain.
  • Huntress published 'Reverse Engineering the Six Stages of MacSync Stealer and RAT,' documenting the full multi-stage chain including polymorphic loader, server-side AppleScript, password validation via dscl, C++ Mach-O RAT with WebSocket C2 over TLS, capture agent for screen recording, and trojanized wallet apps.
  • Microsoft confirmed the infrastructure evolved from Phase 1 (open — malicious command present in HTML source, easy for static scanners to recover) to Phase 2 (cloaked — server-side fingerprinting gate, malicious content withheld until fingerprint evaluation passes).
  • Microsoft Threat Intelligence published analysis of the browser fingerprinting gate evolution: the same infrastructure cluster that previously served ClickFix lures directly in HTML now deploys a ~2.5 KB server-side JavaScript profiling gate across 250+ algorithmically generated domains. The fingerprinting gate (WebGL GPU, navigator, screen, timezone, anti-analysis probes tagged with mode:php) represents a significant anti-analysis escalation — only qualified macOS targets receive the ClickFix payload while sandboxes and scanners see decoy content.

Sources cited for Over 250 Fake Download Domains Deliver AMOS and MacSync

Detection coverage for TL-2026-1907

As of 2026-08-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1907 across Splunk SPL, Microsoft KQL and Sigma, covering 42 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
42 indicators of compromise · Red and above. Compare plans

Community OSINT corroboration for TL-2026-1907

7 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats