> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide - URL: https://f4n6.co.uk/security-feed/from-open-lures-to-cloaked-gates-how-a-macos-clickfix-campaign-learned-to-hide/ - Published: 2026-08-05T21:21:59.000Z - Updated: 2026-08-05T21:21:59.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Microsoft Threat Intelligence documents a macOS ClickFix campaign distributing infostealers — including Atomic Stealer (AMOS) and MacSync — through 250+ algorithmically named domains. The operation has evolved from openly serving malicious Terminal commands in HTML to deploying a server-side browser-fingerprinting gate (TDS) that selectively serves the ClickFix lure only to visitors passing hardware and browser checks consistent with a genuine macOS environment. This cloaking degrades automated detection and sandbox analysis, meaning conventional URL scanning may return benign decoy content from infrastructure that is actively malicious. EMEA financial services with macOS-using staff — particularly developers, traders, and executives — face credential theft risk from browser data, Keychain, and cryptocurrency wallets. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. While the campaign targets endpoint devices that may process financial data, the threat is a broad social-engineering operation against macOS users generally; there is no trigger fact in the source material that is distinctive to this item and changes a specific DORA or NIS2 obligation beyond generic ICT security hygiene. ## 3\. Technical analysis & attack chain This is a threat-campaign advisory. No verified CVE reference data was resolved for this item; the campaign relies entirely on social engineering (ClickFix) and does not exploit a known software vulnerability. ### Attack chain (confirmed steps) 1. **Initial access — Domain registration and cloaking gate.** The actor registers mass-produced domains following a naming convention using the token "file" combined with dictionary words (e.g., `filecopperbasket`, `filevelvettractor`, `fileoceanhammer`, `filemarblegarden`). Some variants place "file" mid-string or omit it (e.g., `cloudsendhub`, `syncdatavault`). These domains host a server-side Traffic Distribution System (TDS) gate — a \~2.5 KB JavaScript profiling routine — instead of serving the lure directly. 2. **Fingerprinting and visitor qualification.** The gate collects browser, hardware, and runtime attributes from six DOM objects (`navigator`, `screen`, `window`, `document`, `location`, `console`). From `navigator`, it captures `platform` (e.g., "MacIntel"), user agent, language, vendor, and plugins. Display values from `screen` and `window` (screen size, color depth, window dimensions, pixel ratio) are checked for consistency with a non-virtualised Mac. The fingerprint object is tagged with `mode: "php"` and submitted to the server. 3. **Anti-analysis probes.** The gate performs three notable checks: - **WebGL GPU profiling:** Retrieves GPU vendor/renderer strings to distinguish real Apple hardware from virtualised, emulated, or software-rendered environments. - **toString() counter:** Creates a temporary function whose `toString()` method increments a counter, then writes the function to `console`. If developer tools are open or a headless tool serialises console output, the counter increments, flagging the environment. - **Prototype-tamper tripwire:** Calls `canPlayType("video/mp4")`. If the hooked `Array.prototype.includes` is triggered (indicating JavaScript-faked codec support in automated/stealth browsers), the gate sets a `proto:true` signal. - Additional probes check timezone configuration, touch-input support, and whether the page is running inside an embedded frame. 4. **Content delivery decision.** Based on the submitted fingerprint, the server returns one of three responses: (a) an empty/parked-looking page to simple crawlers; (b) a benign decoy page (fake VPN landing, browser-extension page, or impersonated business) to JS-capable crawlers and sandboxes that fail fingerprinting; (c) the ClickFix lure — a counterfeit "Download for macOS" page with GitHub-themed branding — to qualifying macOS visitors. 5. **Execution — ClickFix Terminal command.** The victim is instructed to copy and paste a command into Terminal. The command retrieves a remote script from a `/curl/` URL path. Because execution originates from a user-run Terminal command rather than a downloaded app bundle, the flow bypasses macOS quarantine handling, code-signing evaluation, and notarisation checks. 6. **Staging and payload delivery.** The chain progresses through multiple script stages. In a corroborated AMOS infection documented by SANS ISC (single-sourced lab observation; verify before enforcement), the initial zsh script retrieved from the Terminal command downloads a gzip-compressed second-stage script, which in turn downloads a Mach-O universal binary (x86\_64 & arm64) saved to `/tmp/helper` (SHA-256: `9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab`, 297,952 bytes). A persistent binary is installed at `/Users/[username]/Library/Application Support/.com.apple.accountsd/AccountsHelper` (SHA-256: `0a03cf18de28017c0ea591dffc380a6b41fedd2acc3a39e901e58d9188c01836`, 438,656 bytes). 7. **Credential access and exfiltration.** AMOS harvests credentials, browser data, cryptocurrency wallet data, authentication stores, and Keychain contents. C2 traffic observed by SANS ISC uses HTTP POST/GET over TCP port 80 to `188.166.78[.]138` with API paths including `/api/metrics/run?event=started&stage=boot`, `/api/metrics/run?event=stage&stage=credentials`, `/api/metrics/run?event=stage&stage=wallets`, `/api/join/`, `/api/tasks/ack`, and `/api/feed/register`. **Related campaign — ClickLock Stealer (single-sourced; Group-IB via Malwarebytes and The Register):** A separate but thematically related macOS infostealer, "ClickLock Stealer," was discovered via a malicious shell script uploaded to VirusTotal on June 9 with zero AV detections. Active since approximately May, it has targeted at least 100 victims across 33 countries, with over half in Europe. ClickLock uses a fake Cloudflare verification flow, displays a fake macOS password prompt using the victim's real username, and if the password is refused, enters a "kill loop" running every 210 milliseconds for up to 83 hours — killing Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, and all major browsers. It deploys a GSocket backdoor for persistent remote access and exfiltrates stolen data to a Telegram channel. Attribution to a named actor is unconfirmed; no MITRE actor profile is available in the verified reference data. ## 4\. Mitigation & containment ### P1 — Within 24 hours - Block the 17 domains listed in §5 at DNS resolver, web proxy, and firewall levels. These are confirmed ClickFix front-end domains from Microsoft Threat Intelligence. - Block the C2 IP `188.166.78[.]138` at egress firewall and proxy (single-sourced from SANS ISC lab observation; corroborate before enterprise-wide enforcement). - Hunt for the AMOS persistence path pattern: `~/Library/Application Support/.com.apple.accountsd/AccountsHelper` across macOS endpoints. The dot-prefixed directory and misleading "accountsd" name are distinctive. - Search `/tmp/helper` for the AMOS staging binary (SHA-256: `9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab`). ### P2 — Within 72 hours - Ensure all macOS endpoints are running macOS 26.4 (Tahoe) or later. Apple introduced a Terminal paste-warning mitigation in this version that directly addresses the ClickFix delivery vector — it displays "Possible malware, Paste blocked" when a user attempts to paste a potentially malicious command. - Deploy or verify EDR behavioural detections for the following Microsoft Defender for Endpoint signatures (if using MDE): `Behavior:MacOS/SuspAmosExecution`, `Behavior:MacOS/SuspOsascriptExec`, `Behavior:MacOS/SuspDownloadFileExec`, `Behavior:MacOS/SuspInfoExfil`, `Behavior:MacOS/SuspKeyChainCopy.AB`, `Behavior:MacOS/SuspInfostealExec`, `Behavior:MacOS/SuspCredCopy`, `Behavior:MacOS/SuspPassSteal`. - Enable Microsoft Defender SmartScreen for Edge users on macOS; it blocks known ClickFix landing pages. - Deploy browser extensions that warn on clipboard-write events by untrusted pages (e.g., Malwarebytes Browser Guard) to macOS endpoints. ### P3 — Within 7 days - Conduct user awareness training specifically on ClickFix social engineering: no legitimate website, CAPTCHA, or verification process requires pasting a command into Terminal. - Implement network-level detection for the TDS gate fingerprint: look for self-submitting fingerprinting forms, hidden fingerprint data fields, and the `mode:"php"` parameter in POST data to domains matching the `file` naming convention. - Review web proxy logs for the `/curl/` URL path pattern, which is distinctive to this campaign's staging infrastructure. - If ClickLock Stealer is a concern (European exposure confirmed), hunt for GSocket backdoor artefacts and unexpected process termination patterns (Finder, Dock, Terminal being repeatedly killed). ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------- | -------------------------------------------------------------------------------------------------- | ---------- | ------------------------- | | domain | applefilevault\[.\]com | High | Microsoft | | domain | apricotfilepoint\[.\]com | High | Microsoft | | domain | bananafastfile\[.\]com | High | Microsoft | | domain | cloudfilebridge\[.\]com | High | Microsoft | | domain | filecedarwallet\[.\]online | High | Microsoft | | domain | filecopperbasket\[.\]sbs | High | Microsoft | | domain | filecrimsonsignal\[.\]online | High | Microsoft | | domain | filemarblegarden\[.\]sbs | High | Microsoft | | domain | fileoceanhammer\[.\]sbs | High | Microsoft | | domain | filerubyfolder\[.\]sbs | High | Microsoft | | domain | filevelvettractor\[.\]sbs | High | Microsoft | | domain | lemonfilewave\[.\]com | High | Microsoft | | domain | limefilescope\[.\]com | High | Microsoft | | domain | mangocloudfile\[.\]com | High | Microsoft | | domain | orangesmartfile\[.\]com | High | Microsoft | | domain | syncdatavault\[.\]com | High | Microsoft | | domain | cloudsendhub\[.\]com | High | Microsoft | | domain | getmacouscloud\[.\]com | Medium | SANS ISC (single-sourced) | | domain | macspheres\[.\]com | Medium | SANS ISC (single-sourced) | | domain | render65\[.\]com | Medium | SANS ISC (single-sourced) | | domain | grove-89\[.\]com | Medium | SANS ISC (single-sourced) | | ipv4 | 188.166.78\[.\]138 | Medium | SANS ISC (single-sourced) | | sha256 | b9ec3261d633c289e51c5fa8842af4350efe68446df39cb995de82e0941d0f3c | Medium | SANS ISC (single-sourced) | | sha256 | 13b868b3ea8b492e7fbab1ca04535c53d0930650185b5a082cd59c1974689cd5 | Medium | SANS ISC (single-sourced) | | sha256 | 9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab | Medium | SANS ISC (single-sourced) | | sha256 | 0a03cf18de28017c0ea591dffc380a6b41fedd2acc3a39e901e58d9188c01836 | Medium | SANS ISC (single-sourced) | | filepath | /tmp/helper | Medium | SANS ISC (single-sourced) | | filepath | /Users/\[username\]/Library/Application Support/.com.apple.accountsd/AccountsHelper | Medium | SANS ISC (single-sourced) | | url | hxxps\[:\]//macostruecloud\[.\]xyz/?h=2f9548d041648a8030c040ae0e1e530b&z=304 | Medium | SANS ISC (single-sourced) | | url | hxxps\[:\]//render65\[.\]com/curl/f5509695dd98a9732378e5256d6235415d64d92194459bb08525c7ce5991a0c9 | Medium | SANS ISC (single-sourced) | ```iocs domain applefilevault[.]com domain apricotfilepoint[.]com domain bananafastfile[.]com domain cloudfilebridge[.]com domain filecedarwallet[.]online domain filecopperbasket[.]sbs domain filecrimsonsignal[.]online domain filemarblegarden[.]sbs domain fileoceanhammer[.]sbs domain filerubyfolder[.]sbs domain filevelvettractor[.]sbs domain lemonfilewave[.]com domain limefilescope[.]com domain mangocloudfile[.]com domain orangesmartfile[.]com domain syncdatavault[.]com domain cloudsendhub[.]com domain getmacouscloud[.]com domain macspheres[.]com domain render65[.]com domain grove-89[.]com ipv4 188.166.78[.]138 sha256 b9ec3261d633c289e51c5fa8842af4350efe68446df39cb995de82e0941d0f3c sha256 13b868b3ea8b492e7fbab1ca04535c53d0930650185b5a082cd59c1974689cd5 sha256 9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab sha256 0a03cf18de28017c0ea591dffc380a6b41fedd2acc3a39e901e58d9188c01836 filepath /tmp/helper filepath /Users/[username]/Library/Application Support/.com.apple.accountsd/AccountsHelper url hxxps[:]//macostruecloud[.]xyz/?h=2f9548d041648a8030c040ae0e1e530b&z=304 url hxxps[:]//render65[.]com/curl/f5509695dd98a9732378e5256d6235415d64d92194459bb08525c7ce5991a0c9 ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | -------------------- | | Self-submitting fingerprinting form with mode:"php" parameter in POST body | Web proxy / WAF logs | High | | JavaScript page (\~2.5 KB) collecting navigator.platform, WebGL GPU strings, screen dimensions before rendering visible content | Browser instrumentation / sandbox | High | | Domains matching file naming convention returning different content to different user agents | DNS/HTTP proxy logs, passive DNS | High | | HTTP traffic to /curl/ URL path from macOS endpoint | EDR network telemetry, proxy logs | Medium | | HTTP POST/GET to /api/metrics/run?event=stage&stage= paths over port 80 | EDR, network firewall, proxy | Medium | | Mach-O binary written to /tmp/helper then moved to \~/Library/Application Support/.com.apple.accountsd/AccountsHelper | EDR file events, macOS Endpoint Security framework | Medium | | Repeated process termination of Finder, Dock, Terminal every \~210ms (ClickLock variant) | EDR process telemetry | Low (single-sourced) | ## 6\. Detection ```yara rule AMOS_ClickFix_Stage1_Zsh { meta: author = "Adverse Trace" date = "2026-08-05" reference = "https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/" description = "Detects AMOS ClickFix initial-stage zsh scripts based on staging URL patterns and file paths observed in SANS ISC analysis" strings: $curl_path = "/curl/" ascii $tmp_helper = "/tmp/helper" ascii $accounts_helper = ".com.apple.accountsd/AccountsHelper" ascii $api_metrics = "/api/metrics/run" ascii $stage_boot = "event=started&stage=boot" ascii $stage_credentials = "stage=credentials" ascii $stage_wallets = "stage=wallets" ascii condition: 3 of them } rule ClickFix_TDS_Gate_JavaScript { meta: author = "Adverse Trace" date = "2026-08-05" reference = "https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/" description = "Detects the ClickFix TDS fingerprinting gate JavaScript based on profiling logic artefacts described by Microsoft" strings: $mode_php = "mode" ascii $canplay_mp4 = "canPlayType" ascii $video_mp4 = "video/mp4" ascii $proto_includes = "Array.prototype.includes" ascii $macintel = "MacIntel" ascii $navigator_platform = "navigator.platform" ascii condition: 4 of them and filesize < 10240 } ``` ```yaml title: macOS AMOS Stealer Persistence via AccountsHelper id: 7a3c1f2e-8b5d-4a6e-9c0f-1d2e3f4a5b6c status: experimental description: Detects AMOS stealer persistence binary at the dot-prefixed AccountsHelper path author: Adverse Trace date: 2026/08/05 references: - https://isc.sans.edu/diary/rss/33208 - https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/ logsource: product: macos category: file_event detection: selection_persistence_path: TargetFilename|contains: - 'Library/Application Support/.com.apple.accountsd/AccountsHelper' selection_staging: TargetFilename|endswith: - '/tmp/helper' condition: selection_persistence_path or selection_staging falsepositives: - Unknown; the .com.apple.accountsd path with a leading dot is not a legitimate Apple path level: high ``` ```yaml title: macOS AMOS C2 Beacon to API Metrics Endpoint id: 8b4d2g3f-9c6e-5b7f-0d1a-2e3f4a5b6c7d status: experimental description: Detects AMOS stealer C2 traffic to /api/metrics/run with stage parameters over HTTP author: Adverse Trace date: 2026/08/05 references: - https://isc.sans.edu/diary/rss/33208 logsource: product: macos category: network_connection detection: selection_metrics: DestinationHostname|contains: - '188.166.78.138' DestinationPort: 80 selection_paths: RequestURI|contains: - '/api/metrics/run?event=started&stage=boot' - '/api/metrics/run?event=stage&stage=credentials' - '/api/metrics/run?event=stage&stage=wallets' - '/api/join/' - '/api/tasks/ack' - '/api/feed/register' condition: selection_metrics and selection_paths falsepositives: - Unlikely; the combination of hardcoded IP, port 80, and API path pattern is distinctive level: high ``` ## 7\. Sources - Microsoft Security Blog — "From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide" — https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/ — 2026-08-05 - SANS Internet Storm Center — "Atomic MacOS (AMOS) stealer infection" — https://isc.sans.edu/diary/rss/33208 — 2026-08-02 - Malwarebytes Labs — "New ClickLock Stealer locks your Mac until you hand over your password" — https://www.malwarebytes.com/blog/news/2026/07/new-clicklock-stealer-locks-your-mac-until-you-hand-over-your-password — 2026-07 - The Register — "C'mon, just copy this text string and paste it into your macOS Terminal" — https://www.theregister.com/cyber-crime/2026/07/16/cmon-just-copy-this-text-string-and-paste-it-into-your-macos-terminal-itll-fix-your-computer-honest/5273701 — 2026-07-16 - Help Net Security — "ClickFix is changing the economics of social engineering" — https://www.helpnetsecurity.com/2026/07/15/clickfix-social-engineering-attacks-report/ — 2026-07-15 - BleepingComputer — "New macOS ClickFix attack silently mounts DMGs to push infostealer" — https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/ — 2026 ## 8\. Adverse Trace position This campaign represents a meaningful tradecraft escalation in the macOS infostealer ecosystem. The server-side TDS fingerprinting gate — combining WebGL GPU profiling, a `toString()` console counter, and an `Array.prototype.includes` prototype-tamper tripwire — is specifically designed to defeat the automated analysis and sandbox pipelines that security teams rely on for URL triage. The 250+ domain cluster and algorithmic naming convention indicate industrialised infrastructure, not a boutique operation. For EMEA financial services, the risk is concentrated in macOS endpoints used by staff who may be targeted with fake software-download lures; the AMOS payload harvests browser credentials, Keychain data, and cryptocurrency wallets, which may include corporate authentication material. The SANS ISC IOCs (C2 IP, file hashes, persistence path) are single-sourced from a lab observation and should be corroborated before enterprise-wide enforcement. The Microsoft domain list is high-confidence and actionable immediately. We will continue tracking this domain cluster for rotation and will update clients if the TDS gate logic appears in additional infrastructure or if the ClickLock Stealer variant is observed targeting financial services organisations specifically. Attribution to any named threat actor is unconfirmed; no MITRE actor profile is available in the verified reference data. --- [Read the original source →](https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*