A macOS ClickFix operation surpasses 250 front-end domains by fingerprinting users before determining if they should be shown a malware lureshopper. Microsoft revealed that this gateway facilitated the distribution of MacSync and Atomic Stealer (AMOS). Earlier pages contained ClickFix instructions, clipboard logic, obfuscated shell commands, and encoded staging addresses directly within their HTML, making them susceptible to static scanners for recovery.
The script's JavaScript component is approximately 2.5 KB in size and reads navigator values such as the platform string, which should indicate MacIntel on a genuine Mac, along with screen and window dimensions, and WebGL graphics signals that differentiate between actual Apple hardware and virtual machines or emulated environments.
Two specific probes identify analysts: a counter that increments when the developer console is open, and a JavaScript call to canPlayType("video/mp4") as a tripwire to detect fake codec support in browsers attempting to mimic native media player functionality. Defenders should keep an eye on browsing sessions followed by unusual Terminal activity, particularly when curl is piped into zsh, Base64 decoding, osascript, and the creation of archives that are then sent via outbound HTTP POST requests. Terminal prompts users who haven't opened it in the past 30 days or don't have common developer tools installed, as well as those who paste commands from browsers or messaging apps into any terminal emulator.
