The macOS ClickFix chain now qualifies visitors server-side before showing the lure, with anti-analysis probes that detect a console rather than a sandbox
Microsoft documents the cloaking layer in front of a ClickFix campaign, researchers and scanners get a decoy, qualified Macs get the payload
Defender actions
- Roll macOS endpoints to 26.4 or later where the estate allows it: that release adds a native warning when a user pastes a potentially malicious command into Terminal, which is the delivery step this campaign depends on and the only control that engages before execution.
- Add a detection on the
file<word><word>domain-generation pattern in DNS and proxy telemetry rather than a blocklist of the individual hostnames, Microsoft names this as the pivot to hunt and counted more than 250 front-end domains in one tracking window.
Analysis
The interesting part of this campaign is no longer the lure but the doorway in front of it. Microsoft Threat Intelligence reports that the macOS ClickFix activity it has been tracking now performs visitor qualification on the server before it will show anything malicious: "Rather than immediately presenting a malicious command, the actor performs server-side victim qualification before revealing the lure, reducing visibility to researchers and automated security systems while maintaining access to intended macOS targets" (Microsoft Threat Intelligence, 2026-08-05). The gate is hosted across a large set of algorithmically generated domains, Microsoft "confirmed more than 250 ClickFix front-end domains during the tracking window, and many followed a repeated naming pattern using the token “file” with dictionary-style words", i.e. a file<word><word> construction (and the decision is not made in the browser where an analyst could read it) "the gate profiles each visitor using a combination of browser, hardware, and runtime attributes, which are submitted to the server for evaluation" (Microsoft Threat Intelligence, 2026-08-05). A visitor that fails qualification receives a decoy page or nothing at all, which is why a scanner's verdict on one of these URLs is close to worthless.
The profiling itself is broader than the usual sandbox checks. Microsoft describes collection across the browser's navigator, screen, window, document, location and console objects, a WebGL query for genuine graphics hardware, and environmental signals including timezone, iframe presence and touch-input support. Two probes stand out because they target the analyst rather than the machine. The first is a counter driven by JavaScript's own string coercion: "the script creates a temporary function whose toString() method increases a counter, then writes that function to the console" (Microsoft Threat Intelligence, 2026-08-05). In a normal browser that counter usually stays put, because nothing serialises the function; if the developer console is open, or a headless or log-capturing tool serialises console output, the function gets converted to a string and the counter moves. The check does not ask "am I in a VM?"; it asks "is somebody reading this page's console?", which a well-built analysis harness answers in the affirmative precisely because it is instrumented. The second is prototype-tampering detection, which catches the hooking that instrumentation frameworks rely on.
A qualified visitor is served a counterfeit page presenting a "Verified Publisher" framing and a Download for macOS action carrying an obfuscated curl one-liner, in the ClickFix pattern of getting the user to paste and run a command themselves. That command retrieves a staged script from a structured path on the operator's infrastructure, and the chain ends in an infostealer, Microsoft names MacSync and Atomic Stealer (AMOS) as the families delivered, collecting credentials, browser data and cryptocurrency-wallet contents (Microsoft Threat Intelligence, 2026-08-05).
Cited evidence
Rather than immediately presenting a malicious command, the actor performs server-side victim qualification before revealing the lure, reducing visibility to researchers and automated security systems while maintaining access to intended macOS targets.
The gate profiles each visitor using a combination of browser, hardware, and runtime attributes, which are submitted to the server for evaluation.
The script creates a temporary function whose toString() method increases a counter, then writes that function to the console.
On macOS 26.4 and later, Apple introduced a mitigation that displays a warning when a user attempts to paste a potentially malicious command into Terminal, directly addressing the ClickFix delivery mechanism.
Where feasible, alert the file<word><word> domain pattern rather than maintaining a list of individual domains.
Sources1
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.