ctipilot.ch

ClickFix macOS expansion

campaign · campaign:clickfix-macos-2026 single-source

ClickFix social engineering expands to macOS: Macsync / Shub Stealer / AMOS delivered via Base64 Terminal-paste lures that bypass Gatekeeper (Microsoft research).

Coverage timeline
1
first 2026-05-10 → last 2026-08-07
Peak priority
notable
1 notable
Sources cited
1
1 hosts
Sections touched
1
active-threats
Co-occurring entities
0
no co-occurrence
ATT&CK techniques
9
pinned v19.1 · see below

Hunting pivots

Affected products
Apple macOS

ATT&CK techniques

9 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Resource Development TA0042

T1608.004Stage Capabilities: Drive-by Target×1

Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure).

Evidence: 2026-08-07/macos-clickfix-server-side-fingerprinting-gate-amos · ATT&CK page ↗

Initial Access TA0001

T1189Drive-by Compromise×1

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:

Evidence: 2026-08-07/macos-clickfix-server-side-fingerprinting-gate-amos · ATT&CK page ↗

Execution TA0002

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-08-07/macos-clickfix-server-side-fingerprinting-gate-amos · ATT&CK page ↗

T1204.004User Execution: Malicious Copy and Paste×1

An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code.

Evidence: 2026-08-07/macos-clickfix-server-side-fingerprinting-gate-amos · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-08-07/macos-clickfix-server-side-fingerprinting-gate-amos · ATT&CK page ↗

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-08-07/macos-clickfix-server-side-fingerprinting-gate-amos · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-08-07/macos-clickfix-server-side-fingerprinting-gate-amos · ATT&CK page ↗

T1555.003Credentials from Password Stores: Credentials from Web Browsers×1

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-08-07/macos-clickfix-server-side-fingerprinting-gate-amos · ATT&CK page ↗

Discovery TA0007

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-08-07/macos-clickfix-server-side-fingerprinting-gate-amos · ATT&CK page ↗

Command and Control TA0011

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-08-07/macos-clickfix-server-side-fingerprinting-gate-amos · ATT&CK page ↗

Story timeline

  1. 2026-08-07The macOS ClickFix chain now qualifies visitors server-side before showing the lure, with anti-analysis probes that detect a console rather than a sandbox
    active-threatsMicrosoft documents the cloaking layer in front of a ClickFix campaign — researchers and scanners get a decoy, qualified Macs get the payload

Where this entity is cited

  • active-threats1

Source distribution

  • microsoft.com1 (100%)

explore in graph

Entries about ClickFix macOS expansion (1)

2026-08-07 · view entry permalink →

NOTABLENATOB2

The macOS ClickFix chain now qualifies visitors server-side before showing the lure, with anti-analysis probes that detect a console rather than a sandbox

The interesting part of this campaign is no longer the lure but the doorway in front of it. Microsoft Threat Intelligence reports that the macOS ClickFix activity it has been tracking now performs visitor qualification on the server before it will show anything malicious: "Rather than immediately presenting a malicious command, the actor performs server-side victim qualification before revealing the lure, reducing visibility to researchers and automated security systems while maintaining access to intended macOS targets" (Microsoft Threat Intelligence, 2026-08-05). The gate is hosted across a large set of algorithmically generated domains — Microsoft "confirmed more than 250 ClickFix front-end domains during the tracking window, and many followed a repeated naming pattern using the token “file” with dictionary-style words", i.e. a file<word><word> construction — and the decision is not made in the browser where an analyst could read it — "the gate profiles each visitor using a combination of browser, hardware, and runtime attributes, which are submitted to the server for evaluation" (Microsoft Threat Intelligence, 2026-08-05). A visitor that fails qualification receives a decoy page or nothing at all, which is why a scanner's verdict on one of these URLs is close to worthless.

The profiling itself is broader than the usual sandbox checks. Microsoft describes collection across the browser's navigator, screen, window, document, location and console objects, a WebGL query for genuine graphics hardware, and environmental signals including timezone, iframe presence and touch-input support. Two probes stand out because they target the analyst rather than the machine. The first is a counter driven by JavaScript's own string coercion: "the script creates a temporary function whose toString() method increases a counter, then writes that function to the console" (Microsoft Threat Intelligence, 2026-08-05). In a normal browser that counter usually stays put, because nothing serialises the function; if the developer console is open, or a headless or log-capturing tool serialises console output, the function gets converted to a string and the counter moves. The check does not ask "am I in a VM?" — it asks "is somebody reading this page's console?", which a well-built analysis harness answers in the affirmative precisely because it is instrumented. The second is prototype-tampering detection, which catches the hooking that instrumentation frameworks rely on.

A qualified visitor is served a counterfeit page presenting a "Verified Publisher" framing and a Download for macOS action carrying an obfuscated curl one-liner, in the ClickFix pattern of getting the user to paste and run a command themselves. That command retrieves a staged script from a structured path on the operator's infrastructure, and the chain ends in an infostealer — Microsoft names MacSync and Atomic Stealer (AMOS) as the families delivered — collecting credentials, browser data and cryptocurrency-wallet contents (Microsoft Threat Intelligence, 2026-08-05).

Rather than immediately presenting a malicious command, the actor performs server-side victim qualification before revealing the lure, reducing visibility to researchers and automated security systems while maintaining access to intended macOS targets.

The gate profiles each visitor using a combination of browser, hardware, and runtime attributes, which are submitted to the server for evaluation.

The script creates a temporary function whose toString() method increases a counter, then writes that function to the console.

On macOS 26.4 and later, Apple introduced a mitigation that displays a warning when a user attempts to paste a potentially malicious command into Terminal, directly addressing the ClickFix delivery mechanism.

Where feasible, alert the file<word><word> domain pattern rather than maintaining a list of individual domains.

Microsoft Threat Intelligence 2026-08-05
threat07 Aug 04:41Zsingle-sourceOpen finding ↗