From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

1. Executive summary

Microsoft Threat Intelligence documents a macOS ClickFix campaign distributing infostealers — including Atomic Stealer (AMOS) and MacSync — through 250+ algorithmically named domains. The operation has evolved from openly serving malicious Terminal commands in HTML to deploying a server-side browser-fingerprinting gate (TDS) that selectively serves the ClickFix lure only to visitors passing hardware and browser checks consistent with a genuine macOS environment. This cloaking degrades automated detection and sandbox analysis, meaning conventional URL scanning may return benign decoy content from infrastructure that is actively malicious. EMEA financial services with macOS-using staff — particularly developers, traders, and executives — face credential theft risk from browser data, Keychain, and cryptocurrency wallets.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. While the campaign targets endpoint devices that may process financial data, the threat is a broad social-engineering operation against macOS users generally; there is no trigger fact in the source material that is distinctive to this item and changes a specific DORA or NIS2 obligation beyond generic ICT security hygiene.

3. Technical analysis & attack chain

This is a threat-campaign advisory. No verified CVE reference data was resolved for this item; the campaign relies entirely on social engineering (ClickFix) and does not exploit a known software vulnerability.

Attack chain (confirmed steps)

1. Initial access — Domain registration and cloaking gate. The actor registers mass-produced domains following a naming convention using the token "file" combined with dictionary words (e.g., filecopperbasket, filevelvettractor, fileoceanhammer, filemarblegarden). Some variants place "file" mid-string or omit it (e.g., cloudsendhub, syncdatavault). These domains host a server-side Traffic Distribution System (TDS) gate — a ~2.5 KB JavaScript profiling routine — instead of serving the lure directly.
2. Fingerprinting and visitor qualification. The gate collects browser, hardware, and runtime attributes from six DOM objects (navigator, screen, window, document, location, console). From navigator, it captures platform (e.g., "MacIntel"), user agent, language, vendor, and plugins. Display values from screen and window (screen size, color depth, window dimensions, pixel ratio) are checked for consistency with a non-virtualised Mac. The fingerprint object is tagged with mode: "php" and submitted to the server.
3. Anti-analysis probes. The gate performs three notable checks: - WebGL GPU profiling: Retrieves GPU vendor/renderer strings to distinguish real Apple hardware from virtualised, emulated, or software-rendered environments. - toString() counter: Creates a temporary function whose toString() method increments a counter, then writes the function to console. If developer tools are open or a headless tool serialises console output, the counter increments, flagging the environment. - Prototype-tamper tripwire: Calls canPlayType("video/mp4"). If the hooked Array.prototype.includes is triggered (indicating JavaScript-faked codec support in automated/stealth browsers), the gate sets a proto:true signal. - Additional probes check timezone configuration, touch-input support, and whether the page is running inside an embedded frame.
4. Content delivery decision. Based on the submitted fingerprint, the server returns one of three responses: (a) an empty/parked-looking page to simple crawlers; (b) a benign decoy page (fake VPN landing, browser-extension page, or impersonated business) to JS-capable crawlers and sandboxes that fail fingerprinting; (c) the ClickFix lure — a counterfeit "Download for macOS" page with GitHub-themed branding — to qualifying macOS visitors.
5. Execution — ClickFix Terminal command. The victim is instructed to copy and paste a command into Terminal. The command retrieves a remote script from a /curl/<id> URL path. Because execution originates from a user-run Terminal command rather than a downloaded app bundle, the flow bypasses macOS quarantine handling, code-signing evaluation, and notarisation checks.
6. Staging and payload delivery. The chain progresses through multiple script stages. In a corroborated AMOS infection documented by SANS ISC (single-sourced lab observation; verify before enforcement), the initial zsh script retrieved from the Terminal command downloads a gzip-compressed second-stage script, which in turn downloads a Mach-O universal binary (x86_64 & arm64) saved to /tmp/helper (SHA-256: 9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab, 297,952 bytes). A persistent binary is installed at /Users/[username]/Library/Application Support/.com.apple.accountsd/AccountsHelper (SHA-256: 0a03cf18de28017c0ea591dffc380a6b41fedd2acc3a39e901e58d9188c01836, 438,656 bytes).
7. Credential access and exfiltration. AMOS harvests credentials, browser data, cryptocurrency wallet data, authentication stores, and Keychain contents. C2 traffic observed by SANS ISC uses HTTP POST/GET over TCP port 80 to 188.166.78[.]138 with API paths including /api/metrics/run?event=started&stage=boot, /api/metrics/run?event=stage&stage=credentials, /api/metrics/run?event=stage&stage=wallets, /api/join/, /api/tasks/ack, and /api/feed/register.

Related campaign — ClickLock Stealer (single-sourced; Group-IB via Malwarebytes and The Register): A separate but thematically related macOS infostealer, "ClickLock Stealer," was discovered via a malicious shell script uploaded to VirusTotal on June 9 with zero AV detections. Active since approximately May, it has targeted at least 100 victims across 33 countries, with over half in Europe. ClickLock uses a fake Cloudflare verification flow, displays a fake macOS password prompt using the victim's real username, and if the password is refused, enters a "kill loop" running every 210 milliseconds for up to 83 hours — killing Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, and all major browsers. It deploys a GSocket backdoor for persistent remote access and exfiltrates stolen data to a Telegram channel. Attribution to a named actor is unconfirmed; no MITRE actor profile is available in the verified reference data.

4. Mitigation & containment

P1 — Within 24 hours

• Block the 17 domains listed in §5 at DNS resolver, web proxy, and firewall levels. These are confirmed ClickFix front-end domains from Microsoft Threat Intelligence.
• Block the C2 IP 188.166.78[.]138 at egress firewall and proxy (single-sourced from SANS ISC lab observation; corroborate before enterprise-wide enforcement).
• Hunt for the AMOS persistence path pattern: ~/Library/Application Support/.com.apple.accountsd/AccountsHelper across macOS endpoints. The dot-prefixed directory and misleading "accountsd" name are distinctive.
• Search /tmp/helper for the AMOS staging binary (SHA-256: 9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab).

P2 — Within 72 hours

• Ensure all macOS endpoints are running macOS 26.4 (Tahoe) or later. Apple introduced a Terminal paste-warning mitigation in this version that directly addresses the ClickFix delivery vector — it displays "Possible malware, Paste blocked" when a user attempts to paste a potentially malicious command.
• Deploy or verify EDR behavioural detections for the following Microsoft Defender for Endpoint signatures (if using MDE): Behavior:MacOS/SuspAmosExecution, Behavior:MacOS/SuspOsascriptExec, Behavior:MacOS/SuspDownloadFileExec, Behavior:MacOS/SuspInfoExfil, Behavior:MacOS/SuspKeyChainCopy.AB, Behavior:MacOS/SuspInfostealExec, Behavior:MacOS/SuspCredCopy, Behavior:MacOS/SuspPassSteal.
• Enable Microsoft Defender SmartScreen for Edge users on macOS; it blocks known ClickFix landing pages.
• Deploy browser extensions that warn on clipboard-write events by untrusted pages (e.g., Malwarebytes Browser Guard) to macOS endpoints.

P3 — Within 7 days

• Conduct user awareness training specifically on ClickFix social engineering: no legitimate website, CAPTCHA, or verification process requires pasting a command into Terminal.
• Implement network-level detection for the TDS gate fingerprint: look for self-submitting fingerprinting forms, hidden fingerprint data fields, and the mode:"php" parameter in POST data to domains matching the file<word><word> naming convention.
• Review web proxy logs for the /curl/<id> URL path pattern, which is distinctive to this campaign's staging infrastructure.
• If ClickLock Stealer is a concern (European exposure confirmed), hunt for GSocket backdoor artefacts and unexpected process termination patterns (Finder, Dock, Terminal being repeatedly killed).

5. Indicators of compromise

domain  applefilevault[.]com
domain  apricotfilepoint[.]com
domain  bananafastfile[.]com
domain  cloudfilebridge[.]com
domain  filecedarwallet[.]online
domain  filecopperbasket[.]sbs
domain  filecrimsonsignal[.]online
domain  filemarblegarden[.]sbs
domain  fileoceanhammer[.]sbs
domain  filerubyfolder[.]sbs
domain  filevelvettractor[.]sbs
domain  lemonfilewave[.]com
domain  limefilescope[.]com
domain  mangocloudfile[.]com
domain  orangesmartfile[.]com
domain  syncdatavault[.]com
domain  cloudsendhub[.]com
domain  getmacouscloud[.]com
domain  macspheres[.]com
domain  render65[.]com
domain  grove-89[.]com
ipv4  188.166.78[.]138
sha256  b9ec3261d633c289e51c5fa8842af4350efe68446df39cb995de82e0941d0f3c
sha256  13b868b3ea8b492e7fbab1ca04535c53d0930650185b5a082cd59c1974689cd5
sha256  9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab
sha256  0a03cf18de28017c0ea591dffc380a6b41fedd2acc3a39e901e58d9188c01836
filepath  /tmp/helper
filepath  /Users/[username]/Library/Application Support/.com.apple.accountsd/AccountsHelper
url  hxxps[:]//macostruecloud[.]xyz/?h=2f9548d041648a8030c040ae0e1e530b&z=304
url  hxxps[:]//render65[.]com/curl/f5509695dd98a9732378e5256d6235415d64d92194459bb08525c7ce5991a0c9

Behavioural indicators

6. Detection

rule AMOS_ClickFix_Stage1_Zsh {
  meta:
    author = "Adverse Trace"
    date = "2026-08-05"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/"
    description = "Detects AMOS ClickFix initial-stage zsh scripts based on staging URL patterns and file paths observed in SANS ISC analysis"
  strings:
    $curl_path = "/curl/" ascii
    $tmp_helper = "/tmp/helper" ascii
    $accounts_helper = ".com.apple.accountsd/AccountsHelper" ascii
    $api_metrics = "/api/metrics/run" ascii
    $stage_boot = "event=started&stage=boot" ascii
    $stage_credentials = "stage=credentials" ascii
    $stage_wallets = "stage=wallets" ascii
  condition:
    3 of them
}

rule ClickFix_TDS_Gate_JavaScript {
  meta:
    author = "Adverse Trace"
    date = "2026-08-05"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/"
    description = "Detects the ClickFix TDS fingerprinting gate JavaScript based on profiling logic artefacts described by Microsoft"
  strings:
    $mode_php = "mode" ascii
    $canplay_mp4 = "canPlayType" ascii
    $video_mp4 = "video/mp4" ascii
    $proto_includes = "Array.prototype.includes" ascii
    $macintel = "MacIntel" ascii
    $navigator_platform = "navigator.platform" ascii
  condition:
    4 of them and filesize < 10240
}

title: macOS AMOS Stealer Persistence via AccountsHelper
id: 7a3c1f2e-8b5d-4a6e-9c0f-1d2e3f4a5b6c
status: experimental
description: Detects AMOS stealer persistence binary at the dot-prefixed AccountsHelper path
author: Adverse Trace
date: 2026/08/05
references:

  - https://isc.sans.edu/diary/rss/33208
  - https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/
logsource:
  product: macos
  category: file_event
detection:
  selection_persistence_path:
    TargetFilename|contains:

      - 'Library/Application Support/.com.apple.accountsd/AccountsHelper'
  selection_staging:
    TargetFilename|endswith:

      - '/tmp/helper'
  condition: selection_persistence_path or selection_staging
falsepositives:

  - Unknown; the .com.apple.accountsd path with a leading dot is not a legitimate Apple path
level: high

title: macOS AMOS C2 Beacon to API Metrics Endpoint
id: 8b4d2g3f-9c6e-5b7f-0d1a-2e3f4a5b6c7d
status: experimental
description: Detects AMOS stealer C2 traffic to /api/metrics/run with stage parameters over HTTP
author: Adverse Trace
date: 2026/08/05
references:

  - https://isc.sans.edu/diary/rss/33208
logsource:
  product: macos
  category: network_connection
detection:
  selection_metrics:
    DestinationHostname|contains:

      - '188.166.78.138'
    DestinationPort: 80
  selection_paths:
    RequestURI|contains:

      - '/api/metrics/run?event=started&stage=boot'
      - '/api/metrics/run?event=stage&stage=credentials'
      - '/api/metrics/run?event=stage&stage=wallets'
      - '/api/join/'
      - '/api/tasks/ack'
      - '/api/feed/register'
  condition: selection_metrics and selection_paths
falsepositives:

  - Unlikely; the combination of hardcoded IP, port 80, and API path pattern is distinctive
level: high

7. Sources

• Microsoft Security Blog — "From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide" — https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/ — 2026-08-05
• SANS Internet Storm Center — "Atomic MacOS (AMOS) stealer infection" — https://isc.sans.edu/diary/rss/33208 — 2026-08-02
• Malwarebytes Labs — "New ClickLock Stealer locks your Mac until you hand over your password" — https://www.malwarebytes.com/blog/news/2026/07/new-clicklock-stealer-locks-your-mac-until-you-hand-over-your-password — 2026-07
• The Register — "C'mon, just copy this text string and paste it into your macOS Terminal" — https://www.theregister.com/cyber-crime/2026/07/16/cmon-just-copy-this-text-string-and-paste-it-into-your-macos-terminal-itll-fix-your-computer-honest/5273701 — 2026-07-16
• Help Net Security — "ClickFix is changing the economics of social engineering" — https://www.helpnetsecurity.com/2026/07/15/clickfix-social-engineering-attacks-report/ — 2026-07-15
• BleepingComputer — "New macOS ClickFix attack silently mounts DMGs to push infostealer" — https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/ — 2026

8. Adverse Trace position

This campaign represents a meaningful tradecraft escalation in the macOS infostealer ecosystem. The server-side TDS fingerprinting gate — combining WebGL GPU profiling, a toString() console counter, and an Array.prototype.includes prototype-tamper tripwire — is specifically designed to defeat the automated analysis and sandbox pipelines that security teams rely on for URL triage. The 250+ domain cluster and algorithmic naming convention indicate industrialised infrastructure, not a boutique operation. For EMEA financial services, the risk is concentrated in macOS endpoints used by staff who may be targeted with fake software-download lures; the AMOS payload harvests browser credentials, Keychain data, and cryptocurrency wallets, which may include corporate authentication material. The SANS ISC IOCs (C2 IP, file hashes, persistence path) are single-sourced from a lab observation and should be corroborated before enterprise-wide enforcement. The Microsoft domain list is high-confidence and actionable immediately. We will continue tracking this domain cluster for rotation and will update clients if the TDS gate logic appears in additional infrastructure or if the ClickLock Stealer variant is observed targeting financial services organisations specifically. Attribution to any named threat actor is unconfirmed; no MITRE actor profile is available in the verified reference data.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.