Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
Microsoft Threat Intelligence detected a change on infrastructure it has been monitoring for weeks: a macOS ClickFix operation covering more than 250 front-end domains now fingerprints visitors before determining whether to serve them a malware lure.
The server-side gate presents a phony software download to certain Mac users while concealing the malicious page from crawlers and sandboxes. According to Microsoft, the chain it examined through the gate ended in Atomic Stealer (AMOS) and MacSync, which were disseminated throughout the larger cluster.
The user must still copy and execute an obfuscated command in Terminal in order to launch the assault. This program fetches scripts and initiates an infostealer that targets sensitive files, cryptocurrency wallets, browser data, authentic...