A long-running campaign that tricks Mac users into pasting a malicious command into Terminal has started vetting its visitors before it shows them anything. Microsoft Threat Intelligence says the operation now fingerprints every browser that lands on its pages and serves the lure only to what looks like a genuine Mac, leaving security crawlers and sandboxes staring at a blank or harmless page.
The end of the chain has not changed. Victims who follow the instructions get an information stealer, either MacSync or Atomic Stealer, better known as AMOS, which harvests credentials, browser data, cryptocurrency wallet files and authentication stores before sending them out.
What ClickFix is
ClickFix is social engineering, not an exploit. The page tells the user a download, update, CAPTCHA or verification step needs one more action, and hands them a command to copy into Terminal. Because nothing arrives as an application, the flow sidesteps parts of the trust path macOS normally applies to downloaded apps: quarantine handling, code signing evaluation and notarization. We have covered variants that impersonate an Apple security update and one that locks the screen until the victim types their password.
The new layer decides who sees the trap
Microsoft confirmed more than 250 ClickFix front-end domains in this cluster during its tracking window, many of them mass produced by a recognizable name generator built from dictionary words around the token "file": filecopperbasket, filevelvettractor, fileoceanhammer, filemarblegarden. Others move the token or drop it, including applefilevault, bananafastfile, orangesmartfile, cloudsendhub and syncdatavault. Microsoft's team warns defenders to treat the naming pattern as a hunting pivot, not a complete signature.
In the campaign's earlier phase the malicious command sat in the served page's HTML, where any scanner could recover the whole attack without running JavaScript. The same infrastructure now returns a roughly 2.5 kilobyte profiling routine instead. It reads the browser's navigator, screen, window, document, location and console objects, pulls GPU details through WebGL to separate real Apple hardware from virtualized, emulated or software-rendered environments, and checks timezone offset, touch input support and whether the page is running inside an iframe.
Two of the checks are aimed squarely at analysts. One creates a throwaway function whose toString method increments a counter, then writes that function to the console: in a normal browser the counter stays put, but an open developer console or a log capturing tool serializes the function and trips it. The other calls canPlayType("video/mp4"), an ordinary codec support question, as a tripwire, because some stealth browsers fake codec support in JavaScript and give themselves away when that code path hits a hooked function.
The assembled fingerprint, tagged with a mode value of "php", goes back to the server, which then decides what to return. Simple crawlers get an empty, parked-looking page. Sandboxes and JavaScript-capable crawlers that fail the checks get a decoy, in Microsoft's testing a fake Urban VPN browser extension page or a site impersonating a logistics and freight forwarding company. A genuine Mac browser in an expected context gets the counterfeit "Download for macOS" page, complete with a forged "Verified Publisher" badge and a one-click copy button for an obfuscated curl one-liner. The page borrows GitHub branding, which Microsoft notes is spoofed and does not indicate any compromise of GitHub.
Why it matters for defenders
Microsoft's practical warning is that a clean response no longer means a clean domain. The decision is made server side on a per-request basis, so the same URL can hand a scanner a harmless page and the next visitor the lure, and a benign-looking result is not evidence the infrastructure is safe. The compensation is that the gate is often an easier hunting target than the malware behind it, because systems that inspect page content without executing client-side JavaScript can read the profiling logic directly. Microsoft suggests correlating several signals rather than trusting any one, since anti-bot code is common on legitimate sites: self-submitting fingerprint forms, hidden fingerprint data fields, the mode value artifact and the domain naming convention. The full write-up, with the infection chain and hunting guidance, is in the original report.
What you should do
The most effective control here is a message, not a product: no legitimate download, update, CAPTCHA or verification step ever requires pasting a command into Terminal. Beyond that, Microsoft recommends alerting on Terminal or shell sessions that spawn curl, base64, gunzip or osascript, particularly shortly after web browsing, and flagging unusual sequences of native macOS utilities such as curl piped to zsh, base64 -d and xattr -c.
Reported indicators include the gated domain apricotfilepoint[.]com, the file<word><word> domain naming convention, and staging URLs in the form /curl/<id> retrieved by the pasted command.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.