From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
In this article Activity overview How ClickFix works Campaign overview ClickFix moved from open pages to fingerprinting gates The fingerprinting gate Mitigation and protection guidance Indicators of compromise (IOC) References Learn more Microsoft Threat Intelligence observed a macOS ClickFix campaign distributing infostealers, including MacSync and Atomic Stealer (AMOS) , through a large cluster of look-alike domains. The campaign evolved from broadly serving ClickFix lures to using a server-side browser-fingerprinting gate that shows the lure primarily to visitors whose environment appears consistent with a genuine macOS browser. This cloaking limits visibility for crawlers, sandboxes, and some automated analysis workflows. The blog details the domain pattern, fingerprinting checks, infection chain, detection coverage, and hunting pivots that defenders can use to identify related activity. Activity overview Microsoft Threat Intelligence has been tracking a macOS ClickFix operation that distributes information-stealing malware through a large family of algorithmically named domains. Over several weeks of monitoring, Microsoft observed a notable shift in tradecraft: the same infrastructure moved from openly serving the malicious command in the served page’s HTML source to concealing the lure behind a server-side fingerprinting gate that reveals the payload only to visitors the server assesses as a genuine macOS target. The chain ultimately delivers information stealers such as MacSync or Atomic Stealer (AMOS). This activity is consistent with the broader shift in macOS ClickFix tradecraft that Microsoft Threat Intelligence previously documented , in which threat actors instruct users to run Terminal commands that retrieve remotely hosted content rather than the traditional approach of delivering a disk image for manual installation. The cluster described here is notable for two reasons: its domains are mass-produced by a recognizable name generator, and it adopted server-side cloaking on existing infrastructure, giving defenders a clear before-and-after view of the same operation. In this blog, we describe the campaign’s domain-generation pattern, the two delivery phases we observed, the fingerprinting gate that now fronts the infrastructure, and the end-to-end infection chain. We also provide hunting guidance, mitigation recommendations, and defanged indicators of compromise. How ClickFix works ClickFix is a social-engineering technique where attackers persuade users to copy and run a command in Terminal instead of downloading a traditional macOS application. The lure usually appears as a fake verification step, software update, download error, or CAPTCHA, with the command disguised as something required to complete the action. Because execution starts from a user-run Terminal command rather than a downloaded app bundle, the flow can avoid parts of the normal macOS application trust path, including quarantine handling, code-signing evaluation, and notarization checks typically applied to downloaded applications. In this campaign, ClickFix remains the delivery mechanism, but the important change is that the lure is no longer shown to every visitor. The page first profiles the visitor through a browser-fingerprinting gate and primarily requests consistent with a genuine macOS browser environment receive the fake “Download for macOS” page and copied Terminal command. Figure 1a – The counterfeit “Download for macOS” page served to a qualifying visitor by a cloaked gate (apricotfilepoint[.]com). The page displays a forged “Verified Publisher” badge and offers a one-click Copy of an obfuscated curl one-liner. Delivery is conditional. During analysis, the same URLs returned different content to different requests. In some case the macOS ClickFix lure, and in others an apparently benign decoy page. In our testing, a request presenting a Windows browser received a decoy page such as a fake browser-extension or VPN landing page (Figure…
AI Analysis
Technical Summary
The macOS ClickFix campaign distributes infostealers including MacSync and Atomic Stealer via a large family of algorithmically generated domains. Initially, the malicious lure was openly served in the HTML source, but the campaign shifted to a server-side fingerprinting gate that profiles visitors and only serves the macOS-targeted lure to browsers consistent with genuine macOS environments. This cloaking reduces visibility to automated detection systems. The infection chain involves social engineering users to execute obfuscated Terminal commands, bypassing macOS quarantine, code-signing, and notarization protections. The campaign uses forged 'Verified Publisher' badges and obfuscated curl one-liners to deliver payloads. Microsoft provides detailed analysis of domain patterns, delivery phases, fingerprinting techniques, and hunting guidance.
Potential Impact
The campaign results in the installation of information-stealing malware on macOS systems, potentially compromising user credentials and sensitive data. The use of social engineering to execute Terminal commands circumvents standard macOS security mechanisms, increasing the risk of successful infection. The server-side cloaking reduces detection by automated defenses, allowing the campaign to operate with greater stealth and persistence.
Mitigation Recommendations
No official patch or fix is applicable as this is a social engineering and malware distribution campaign rather than a software vulnerability. Defenders should use the provided hunting guidance and indicators of compromise from the Microsoft advisory to detect and block related activity. Awareness training to prevent users from running untrusted Terminal commands is recommended. Network and endpoint monitoring should focus on detecting suspicious domain patterns and command execution consistent with ClickFix lures. Microsoft’s blog provides detailed mitigation and protection guidance.
Indicators of Compromise
- domain: applefilevault.com
- domain: apricotfilepoint.com
- domain: bananafastfile.com
- domain: lemonfilewave.com
- domain: limefilescope.com
- domain: mangocloudfile.com
- domain: orangesmartfile.com
- domain: cloudfilebridge.com
- domain: filecedarwallet.online
- domain: filecopperbasket.sbs
- domain: filecrimsonsignal.online
- domain: filemarblegarden.sbs
- domain: fileoceanhammer.sbs
- domain: filerubyfolder.sbs
- domain: filevelvettractor.sbs
- domain: syncdatavault.com
- domain: cloudsendhub.com
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
Description
In this article Activity overview How ClickFix works Campaign overview ClickFix moved from open pages to fingerprinting gates The fingerprinting gate Mitigation and protection guidance Indicators of compromise (IOC) References Learn more Microsoft Threat Intelligence observed a macOS ClickFix campaign distributing infostealers, including MacSync and Atomic Stealer (AMOS) , through a large cluster of look-alike domains. The campaign evolved from broadly serving ClickFix lures to using a server-side browser-fingerprinting gate that shows the lure primarily to visitors whose environment appears consistent with a genuine macOS browser. This cloaking limits visibility for crawlers, sandboxes, and some automated analysis workflows. The blog details the domain pattern, fingerprinting checks, infection chain, detection coverage, and hunting pivots that defenders can use to identify related activity. Activity overview Microsoft Threat Intelligence has been tracking a macOS ClickFix operation that distributes information-stealing malware through a large family of algorithmically named domains. Over several weeks of monitoring, Microsoft observed a notable shift in tradecraft: the same infrastructure moved from openly serving the malicious command in the served page’s HTML source to concealing the lure behind a server-side fingerprinting gate that reveals the payload only to visitors the server assesses as a genuine macOS target. The chain ultimately delivers information stealers such as MacSync or Atomic Stealer (AMOS). This activity is consistent with the broader shift in macOS ClickFix tradecraft that Microsoft Threat Intelligence previously documented , in which threat actors instruct users to run Terminal commands that retrieve remotely hosted content rather than the traditional approach of delivering a disk image for manual installation. The cluster described here is notable for two reasons: its domains are mass-produced by a recognizable name generator, and it adopted server-side cloaking on existing infrastructure, giving defenders a clear before-and-after view of the same operation. In this blog, we describe the campaign’s domain-generation pattern, the two delivery phases we observed, the fingerprinting gate that now fronts the infrastructure, and the end-to-end infection chain. We also provide hunting guidance, mitigation recommendations, and defanged indicators of compromise. How ClickFix works ClickFix is a social-engineering technique where attackers persuade users to copy and run a command in Terminal instead of downloading a traditional macOS application. The lure usually appears as a fake verification step, software update, download error, or CAPTCHA, with the command disguised as something required to complete the action. Because execution starts from a user-run Terminal command rather than a downloaded app bundle, the flow can avoid parts of the normal macOS application trust path, including quarantine handling, code-signing evaluation, and notarization checks typically applied to downloaded applications. In this campaign, ClickFix remains the delivery mechanism, but the important change is that the lure is no longer shown to every visitor. The page first profiles the visitor through a browser-fingerprinting gate and primarily requests consistent with a genuine macOS browser environment receive the fake “Download for macOS” page and copied Terminal command. Figure 1a – The counterfeit “Download for macOS” page served to a qualifying visitor by a cloaked gate (apricotfilepoint[.]com). The page displays a forged “Verified Publisher” badge and offers a one-click Copy of an obfuscated curl one-liner. Delivery is conditional. During analysis, the same URLs returned different content to different requests. In some case the macOS ClickFix lure, and in others an apparently benign decoy page. In our testing, a request presenting a Windows browser received a decoy page such as a fake browser-extension or VPN landing page (Figure…
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The macOS ClickFix campaign distributes infostealers including MacSync and Atomic Stealer via a large family of algorithmically generated domains. Initially, the malicious lure was openly served in the HTML source, but the campaign shifted to a server-side fingerprinting gate that profiles visitors and only serves the macOS-targeted lure to browsers consistent with genuine macOS environments. This cloaking reduces visibility to automated detection systems. The infection chain involves social engineering users to execute obfuscated Terminal commands, bypassing macOS quarantine, code-signing, and notarization protections. The campaign uses forged 'Verified Publisher' badges and obfuscated curl one-liners to deliver payloads. Microsoft provides detailed analysis of domain patterns, delivery phases, fingerprinting techniques, and hunting guidance.
Potential Impact
The campaign results in the installation of information-stealing malware on macOS systems, potentially compromising user credentials and sensitive data. The use of social engineering to execute Terminal commands circumvents standard macOS security mechanisms, increasing the risk of successful infection. The server-side cloaking reduces detection by automated defenses, allowing the campaign to operate with greater stealth and persistence.
Defensive Guidance
No official patch or fix is applicable as this is a social engineering and malware distribution campaign rather than a software vulnerability. Defenders should use the provided hunting guidance and indicators of compromise from the Microsoft advisory to detect and block related activity. Awareness training to prevent users from running untrusted Terminal commands is recommended. Network and endpoint monitoring should focus on detecting suspicious domain patterns and command execution consistent with ClickFix lures. Microsoft’s blog provides detailed mitigation and protection guidance.
Technical Details
- Classification
- {"confidence":0.73,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/","fetched":true,"fetchedAt":"2026-08-05T18:39:30.721Z","wordCount":3773}
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainapplefilevault.com | — | |
domainapricotfilepoint.com | — | |
domainbananafastfile.com | — | |
domainlemonfilewave.com | — | |
domainlimefilescope.com | — | |
domainmangocloudfile.com | — | |
domainorangesmartfile.com | — | |
domaincloudfilebridge.com | — | |
domainfilecedarwallet.online | — | |
domainfilecopperbasket.sbs | — | |
domainfilecrimsonsignal.online | — | |
domainfilemarblegarden.sbs | — | |
domainfileoceanhammer.sbs | — | |
domainfilerubyfolder.sbs | — | |
domainfilevelvettractor.sbs | — | |
domainsyncdatavault.com | — | |
domaincloudsendhub.com | — |
Threat ID: 6a738364bf8831d53948dfa5
Added to database: 08/05/2026, 18:39:32 UTC
Last enriched: 08/05/2026, 18:40:00 UTC
Last updated: 09/19/2026, 09:39:47 UTC
Views: 131
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.