Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake sof…
Intelligence analysis by Llama
A macOS ClickFix operation has been tracked using browser fingerprinting to hide malware lures from crawlers and sandboxes. The operation presents selected Mac users with a fake software download.
Imagine you're browsing the internet, and a website wants to know if you're using a real Mac or a fake one. They can do this by checking things like your screen size, what kind of browser you're using, and even if you have touch support. If you pass the test, they might show you a fake software download. But if you don't, they might just show you a blank page. It's like a game of cat and mouse between the website and your browser.
Analysis
A New Tactic in macOS Malware Evolution
The recent discovery of a macOS ClickFix operation using browser fingerprinting to hide malware lures marks a new evolution in the tactics used by macOS malware. This operation, spanning over 250 front-end domains, fingerprints visitors before deciding whether to show them a malware lure. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download.
How the Operation Works
The operation works by using a JavaScript script that reads navigator values such as the platform string, screen and window dimensions, and WebGL graphics signals. It also checks the timezone, whether the page is boxed inside an iframe, and whether the device reports touch support. Two probes specifically hunt for analysts: a counter that ticks up when the browser's developer console is open, and a call to canPlayType("video/mp4") repurposed as a tripwire that flags stealth browsers faking codec support in JavaScript.
The Gate's Purpose
The gate's purpose is to hide the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download. This is achieved by server-side fingerprinting, which chooses what the visitor sees based on the browser's fingerprint. A crawler, sandbox, or visitor in an unwanted location may receive a blank page, fake browser extension, or unrelated business site. A request resembling a genuine Mac in the expected context receives a GitHub-themed "Download for macOS" page with a forged "Verified Publisher" badge.
The Malware Behind the Gate
The malware behind the gate is a macOS infostealer that targets credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files. The malware requires the user to copy and run an obfuscated command in Terminal, which retrieves scripts and launches the infostealer. Microsoft has not disclosed victim numbers, targeted sectors, or the identity of the operators.
Defending Against the Operation
Defenders should monitor for browsing followed by unusual Terminal activity, especially curl piped into zsh, Base64 decoding, osascript, and archive creation followed by outbound HTTP POST requests. The recommended move is to hunt the gate rather than the malware behind it: watch for self-submitting fingerprint forms, hidden fingerprint fields, and the mode:"php" artifact, and block on the shared staging infrastructure and /curl/ paths instead of chasing throwaway front-end domains.
Key points
- A macOS ClickFix operation spanning over 250 front-end domains uses browser fingerprinting to hide malware lures from crawlers and sandboxes.
- The operation presents selected Mac users with a fake software download.
- The malware behind the gate is a macOS infostealer that targets credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files.
- Defenders should monitor for browsing followed by unusual Terminal activity, especially curl piped into zsh, Base64 decoding, osascript, and archive creation followed by outbound HTTP POST requests.
If this development plays out positively, it could lead to more effective detection and prevention of macOS malware. By understanding the tactics used by these malware, defenders can develop more targeted and effective countermeasures.
The realistic downside risks or failure modes of this operation include the potential for the malware to evade detection and continue to spread. Additionally, the use of browser fingerprinting could lead to a cat-and-mouse game between the website and the browser, making it difficult to detect and prevent the malware.
