# Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate

> A sophisticated macOS ClickFix campaign deploys over 250 algorithmically generated fake download domains distributing AMOS (Atomic macOS Stealer) and MacSync infostealers. The operation is distinguished by a ~2.5 KB server-side browser-fingerprinting JavaScript gate that profiles visitors across navigator, screen, WebGL GPU, timezone, and anti-analysis probes before conditionally serving malicious payloads — only genuine macOS targets receive the ClickFix lure, while sandboxes, scanners, crawlers, and non-macOS visitors see decoy pages or blank content. This represents a significant TTP escalation from prior ClickFix operations that served the malicious command directly in HTML source.

- **Published:** 2026-08-06T00:00:00Z
- **Last reviewed:** 2026-08-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1907
- **ID:** TL-2026-1907
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 42 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Threat Intelligence tracked an extensive macOS infostealer campaign operating through a cluster of more than 250 algorithmically generated fake download domains. The campaign's defining evolution is a server-side browser-fingerprinting gate — approximately 2.5 KB of JavaScript — that profiles every visitor before deciding whether to serve the malicious payload. The gate collects data from six browser objects (navigator, screen, window, document, location, console), uses WebGL GPU signals to distinguish real Apple hardware from virtualized, emulated, or sandboxed environments, checks timezone offset for geographic plausibility, detects iframe embedding (associated with crawlers), and probes for touch support (uncommon on desktop macOS). Two anti-analysis probes are included: a toString() counter that increments when DevTools or headless log-capturing tools serialize console output, and a repurposed canPlayType('video/mp4') call that serves as a tripwire for stealth browsers faking codec support via hooked JavaScript prototypes. The collected fingerprint, tagged with mode:'php', is silently submitted to the server via a self-submitting form. The server then makes a per-request decision: qualified macOS targets receive a counterfeit GitHub-themed 'Download for macOS' page with a forged 'Verified Publisher' badge offering a one-click 'Copy' button for an obfuscated curl one-liner; all other visitors receive decoy content such as a fake Urban VPN Proxy browser extension landing page, a fake VPN landing page, or pages impersonating an unrelated logistics company. The decoy responses mean that 'an apparently benign or look-alike response does not mean the domain is safe,' as Microsoft noted. The infection chain requires the victim to paste and run the obfuscated Terminal command, which retrieves a remote script from /curl/<id> staging URLs, chains through multiple script stages (using curl, base64, gunzip, chmod, osascript, and xattr), and ultimately delivers either AMOS or MacSync infostealer. AMOS performs comprehensive data theft targeting browser credentials, cryptocurrency wallets, Keychain entries, authentication stores, and sensitive files, exfiltrating via HTTP POST. MacSync employs a more sophisticated six-stage chain documented by Huntress and Sophos: a thin polymorphic zsh loader, a server-side daemon function that fetches in-memory AppleScript via an API-key-gated endpoint, a dynamic AppleScript stealer (~46 KB) that obtains Full Disk Access via social engineering, validates captured passwords against dscl . authonly, and steals Chromium Safe Storage keys, Gecko browser profiles, desktop cryptocurrency wallets, Telegram data, keychain databases, SSH keys, AWS credentials, and Kubernetes configs — all staged under /tmp/sync<random>/ and archived via ditto. A C++ Mach-O RAT (statically linked, OpenSSL 3.6.2, universal x86_64+arm64) is then deployed as a persistent LaunchAgent, communicating over WebSocket over TLS to a bare IP (85.206.161.241:8443) with AES-256-CBC encryption. The RAT supports full interactive shell via forkpty, file upload/download, screen capture (delegated to a separately signed helper app named 'Screen Recording' to obtain TCC approval), and self-removal on server command. Finally, a Stage 6 payload trojanizes installed Ledger Wallet, Ledger Live, and Trezor Suite applications by swapping in patched app.asar files that inject a seed-phrase phishing flow, exfiltrating the BIP39 recovery phrase to attacker-controlled seed drop domains. The infrastructure comprises three tiers: Cloudflare-fronted delivery domains (agenticsora.com, malwareaudit.com, and 250+ file<word><word> domains), a bare-IP TLS-based RAT C2 (85.206.161.241:8443), and seed drop domains (sdhomeinspectors.com, southcarolinacounselor.com) receiving stolen recovery phrases. The shared api-key (9dd465d26c7d86b4a6f514a4b46b2295), shared /curl endpoint, and byte-identical loaders across multiple front domains tie all activity to a single operator. Russian-language comments in the malware source code (including 'ВСТАВЬТЕ СЮДА' for 'INSERT HERE' and 'Убрана хрупкая SafeSQLiteCopy' noting a Firefox crash fix) and a CIS-keyboard-layout kill switch in the loader campaign suggest a Russian-speaking operator. No specific named threat actor or nation-state has been attributed. Active infection clusters were observed across Belgium, India, and parts of North and South America. Apple introduced a mitigation in macOS 26.4+ (March 24, 2026) that blocks pasting potentially malicious commands into Terminal with a 'Possible malware, Paste blocked' warning, and XProtect signatures have been updated. The campaign infrastructure evolved from Phase 1 (open — malicious command present in HTML source, easy for static scanners to recover) to Phase 2 (cloaked — server-side fingerprinting gate, payload hidden from automated analysis), representing a significant anti-analysis evolution in macOS infostealer operations.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1204.001 Malicious Link
- T1106 Native API
- T1543.001 Launch Agent
- T1647 Plist File Modification
- T1554 Compromise Host Software Binary
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1553.002 Code Signing
- T1497 Virtualization/Sandbox Evasion
- T1070.004 File Deletion
- T1564.001 Hidden Files and Directories
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1056.002 GUI Input Capture
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1497.001 System Checks

## Sources

- [From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide](https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [Evil evolution: ClickFix and macOS infostealers](https://www.sophos.com/en-us/blog/evil-evolution-clickfix-and-macos-infostealers)
- [Reverse Engineering the Six Stages of MacSync Stealer and RAT](https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering)
- [Over 250 Fake Download Domains Target Mac Users with AMOS & MacSync Stealers](https://gbhackers.com/250-fake-download-domains/)
- [Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures](https://thehackernews.com/2026/08/over-250-clickfix-domains-use-browser.html)
- [macOS ClickFix deploying AppleScript Stealer & RAT](https://lens.netskope.com/)
- [AMOS C2 protocol analysis from PCAP](https://pcaps.io/blog/)
- [Think before you Click(Fix) — macOS ClickFix campaign analysis](https://www.microsoft.com/en-us/security/blog/2025/08/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1907