macOS ClickFix campaign fingerprints visitors to hide its malware from analysts

Microsoft Threat Intelligence detailed a macOS ClickFix operation spanning more than 250 domains that now fingerprints visitors before deciding whether to show a malware lure. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download, an anti-analysis layer rather than a change to the attack itself. The lure still requires the victim to copy and run an obfuscated command in Terminal, which fetches scripts and installs an infostealer, in this case Atomic Stealer, that targets credentials, browser data, authentication stores, and cryptocurrency wallets. Many domains follow a dictionary-word naming pattern using the word file.

Check

Warn Mac users never to paste and run Terminal commands from a web verification or fix prompt, and use the file-plus-dictionary-word domain pattern as a threat-hunting pivot.

Affected

macOS users who follow fake software-fix prompts; the fingerprinting gate hides the lure from analysis while serving selected victims an infostealer that harvests credentials, browser data, and crypto wallets.

Fix

Update to macOS 26.4 for its new Terminal and XProtect protections, block known campaign domains, monitor endpoints for scripts run from Terminal, and reinforce that legitimate fixes never require pasted commands.