2026-08-07 · view entry permalink →
The macOS ClickFix chain now qualifies visitors server-side before showing the lure, with anti-analysis probes that detect a console rather than a sandbox
The interesting part of this campaign is no longer the lure but the doorway in front of it. Microsoft Threat Intelligence reports that the macOS ClickFix activity it has been tracking now performs visitor qualification on the server before it will show anything malicious: "Rather than immediately presenting a malicious command, the actor performs server-side victim qualification before revealing the lure, reducing visibility to researchers and automated security systems while maintaining access to intended macOS targets" (Microsoft Threat Intelligence, 2026-08-05). The gate is hosted across a large set of algorithmically generated domains, Microsoft "confirmed more than 250 ClickFix front-end domains during the tracking window, and many followed a repeated naming pattern using the token “file” with dictionary-style words", i.e. a file<word><word> construction (and the decision is not made in the browser where an analyst could read it) "the gate profiles each visitor using a combination of browser, hardware, and runtime attributes, which are submitted to the server for evaluation" (Microsoft Threat Intelligence, 2026-08-05). A visitor that fails qualification receives a decoy page or nothing at all, which is why a scanner's verdict on one of these URLs is close to worthless.
The profiling itself is broader than the usual sandbox checks. Microsoft describes collection across the browser's navigator, screen, window, document, location and console objects, a WebGL query for genuine graphics hardware, and environmental signals including timezone, iframe presence and touch-input support. Two probes stand out because they target the analyst rather than the machine. The first is a counter driven by JavaScript's own string coercion: "the script creates a temporary function whose toString() method increases a counter, then writes that function to the console" (Microsoft Threat Intelligence, 2026-08-05). In a normal browser that counter usually stays put, because nothing serialises the function; if the developer console is open, or a headless or log-capturing tool serialises console output, the function gets converted to a string and the counter moves. The check does not ask "am I in a VM?"; it asks "is somebody reading this page's console?", which a well-built analysis harness answers in the affirmative precisely because it is instrumented. The second is prototype-tampering detection, which catches the hooking that instrumentation frameworks rely on.
A qualified visitor is served a counterfeit page presenting a "Verified Publisher" framing and a Download for macOS action carrying an obfuscated curl one-liner, in the ClickFix pattern of getting the user to paste and run a command themselves. That command retrieves a staged script from a structured path on the operator's infrastructure, and the chain ends in an infostealer, Microsoft names MacSync and Atomic Stealer (AMOS) as the families delivered, collecting credentials, browser data and cryptocurrency-wallet contents (Microsoft Threat Intelligence, 2026-08-05).
Rather than immediately presenting a malicious command, the actor performs server-side victim qualification before revealing the lure, reducing visibility to researchers and automated security systems while maintaining access to intended macOS targets.
The gate profiles each visitor using a combination of browser, hardware, and runtime attributes, which are submitted to the server for evaluation.
The script creates a temporary function whose toString() method increases a counter, then writes that function to the console.
On macOS 26.4 and later, Apple introduced a mitigation that displays a warning when a user attempts to paste a potentially malicious command into Terminal, directly addressing the ClickFix delivery mechanism.
Where feasible, alert the file<word><word> domain pattern rather than maintaining a list of individual domains.