macOS ClickFix Campaign Uses Browser Fingerprinting to Deliver Atomic Stealer Malware

The operation relies on hundreds of look-alike domains, fake software-download pages, and Terminal commands designed to steal sensitive data from selected Mac users.

ClickFix attacks use social engineering rather than traditional malicious app downloads. Victims are shown a fake verification prompt, CAPTCHA, update notice, or download error, then instructed to copy and paste a command into Terminal.

In this case, attackers use a counterfeit “Download for macOS” page with a forged “Verified Publisher” label and an obfuscated command presented as part of the download process.

Microsoft said the campaign initially exposed its malicious command directly in webpage source code. That made it easier for scanners and defenders to identify the infrastructure.

The operators have now changed tactics by deploying a server-side fingerprinting gate that decides whether a visitor should see the ClickFix lure.

ClickFix Fingerprints macOS Users

The malicious websites first load a small JavaScript profiling script instead of immediately showing the fake download page.

This script gathers details from browser objects including navigator, screen, window, document, location, and console.

Collected information can include the browser user agent, operating-system platform, language, browser vendor, installed plugins, display resolution, pixel ratio, referrer, page URL, and window size.

The campaign also examines WebGL graphics data, which can help attackers determine whether a visitor is using genuine Apple hardware or a virtualized, emulated, or software-rendered environment.

Additional checks review timezone settings, touch-input support, and whether the page is running inside an iframe.

These signals can reveal suspicious contexts such as headless browsers, mobile emulators, analysis tools, sandbox environments, or automated security crawlers.

The malware operators also use anti-analysis techniques to identify developer tools and browser manipulation. One check monitors whether a temporary function is converted to a string when written to the browser console.

Another misuses a normal MP4 codec capability check to detect altered browser behavior associated with automation or stealth-browser frameworks.

After collecting these details, the browser silently sends the fingerprint data to the attacker-controlled server. The server then chooses what content to return.

A visitor that appears to be a real macOS user may receive the malicious ClickFix page, while a crawler or non-qualifying device may receive a blank page, harmless-looking content, or a fake VPN or browser-extension landing page, Microsoft said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR