Malicious macOS ClickFix Domains Hide Atomic Stealer Attacks via Browser Fingerprinting

Key Takeaways

• A widespread ClickFix campaign is targeting macOS users with over 250 deceptive domains.
• These domains employ advanced browser fingerprinting to selectively deliver the Atomic Stealer (AMOS) malware.
• The attack relies on social engineering, tricking users into executing malicious Terminal commands, rather than exploiting software vulnerabilities.
• Atomic Stealer can exfiltrate sensitive data, including browser credentials, passwords, and cryptocurrency wallet information.
• Detection is challenging due to the fingerprinting mechanism, requiring defenders to focus on behavioral indicators and user education.

Sophisticated ClickFix Campaign Targets macOS Users with Atomic Stealer

A sophisticated ClickFix operation is actively leveraging more than 250 look-alike domains to distribute the Atomic Stealer (AMOS) malware to macOS users. This campaign employs a refined technique of browser fingerprinting to identify and selectively target victims, presenting them with seemingly benign websites that ultimately lead to a malicious Terminal command designed to install the data-stealing malware.

Unlike traditional attacks that exploit software vulnerabilities, the ClickFix campaign is built on social engineering and user persuasion. Victims are lured to pages masquerading as download verification steps, software updates, or CAPTCHA challenges. These pages then prompt users to paste a specific command into their macOS Terminal, initiating the malware infection chain.

Evolving Evasion Tactics

Researchers at Microsoft said in a report that the threat actors have significantly evolved their infrastructure. Previously, malicious instructions were openly displayed, making detection relatively straightforward. The new methodology involves a preliminary screening process for each visitor. This “fingerprinting gate” assesses various browser and system parameters before deciding whether to present the malicious payload, making automated security scans less effective.

Microsoft’s analysis revealed that domains appearing harmless to a security researcher can still serve a highly targeted lure to a genuine macOS browser profile. This enables the Atomic Stealer, also known as AMOS, to proceed with its objective of collecting sensitive personal and business data from unsuspecting users.

Over 250 Deceptive macOS ClickFix Domains Identified

The ClickFix operation is supported by an extensive network of algorithmically generated domain names. Many of these domains incorporate the word “file” alongside common dictionary terms, creating names that mimic legitimate cloud storage, download, or synchronization services. This naming convention is designed to instill a false sense of security and legitimacy.

During their tracking period, Microsoft identified over 250 ClickFix front-end domains. Examples include “filecopperbasket,” “filevelvettractor,” and “fileoceanhammer,” among others that either integrate “file” differently or omit it entirely.

Upon successful fingerprinting, a qualified visitor is redirected to a counterfeit “Download for macOS” page. This page is meticulously styled with GitHub-themed branding, though it’s important to note that this is a spoof and does not indicate any compromise of GitHub itself. The intent behind the branding is to lend credibility to the malicious request, making the user feel safe about executing the provided command.

Once the user copies and executes the single-line command in Terminal, it retrieves a remote script via a /curl/<id> address. Subsequent scripts then download and launch the AMOS malware. Atomic Stealer is known for its capability to exfiltrate a wide range of sensitive information, including browser credentials, stored passwords, cryptocurrency wallet data, authentication tokens, and other critical files.

This attack strategy aligns with the broader ClickFix trend observed on macOS, where attackers prioritize user interaction over exploiting technical vulnerabilities. It underscores the critical importance of treating any request to paste commands into Terminal with extreme suspicion, regardless of how authentic the requesting website may appear.

Fingerprinting Gate Hinders Security Analysis

The core of the campaign’s stealth lies in its advanced browser fingerprinting mechanism. This “gate” collects a comprehensive array of details from the visitor’s browser, screen, window, document, location, and console. This information is then silently transmitted to the server for analysis.

The system meticulously checks various parameters, including the claimed platform, browser settings, display resolutions, language preferences, and other characteristics indicative of a typical Mac desktop session. It also examines graphics information through WebGL, a browser feature primarily used for visual rendering, to further validate the user’s environment.

Additional data points, such as time zone, touch capability, embedded-frame status, and developer-console behavior, help the server identify and filter out virtual machines, automated analysis tools, or research environments. Visitors who fail this comprehensive test are typically presented with a blank page, a seemingly parked website, or a harmless decoy, such as a browser extension or VPN landing page.

Conversely, users whose browser profiles convincingly match a standard macOS environment are served the malicious download instructions. This selective delivery method significantly complicates automated detection efforts and echoes strategies seen in previous fake CAPTCHA campaigns.

What You Should Do

• Educate Users: Regularly remind staff that legitimate software downloads and verification processes do not require pasting commands into the Terminal.
• Behavioral Monitoring: Security teams should actively monitor Terminal sessions for suspicious activities, such as rapid execution of commands like curl, base64, gunzip, or osascript following web browsing. Investigate any unusual sequences that attempt to clear quarantine attributes or make files executable.
• Network Traffic Analysis: Focus network monitoring on encoded or compressed downloads originating from new or low-reputation domains, especially those using /curl/<hex-id> paths. Also, watch for unauthorized access attempts to keychains, browser credential stores, SSH keys, and cryptocurrency wallet data.
• Implement Advanced Detections: Incorporate insights from known Terminal-based malware delivery techniques and Atomic Stealer’s evolving delivery changes into your detection rules.
• Leverage macOS Safeguards: On newer macOS versions, enable and heed warnings that block pasting potentially malicious commands into Terminal. While this is a helpful safeguard, it should be complemented with vigilant user behavior and robust monitoring, as attackers continuously adapt their methods.
• Indicators of Compromise (IoCs):
  • Domain: applefilevault[.]com
  • Domain: apricotfilepoint[.]com
  • Domain: bananafastfile[.]com
  • Domain: cloudfilebridge[.]com
  • Domain: filecedarwallet[.]online
  • Domain: filecopperbasket[.]sbs
  • Domain: filecrimsonsignal[.]online
  • Domain: filemarblegarden[.]sbs
  • Domain: fileoceanhammer[.]sbs
  • Domain: filerubyfolder[.]sbs
  • Domain: filevelvettractor[.]sbs
  • Domain: lemonfilewave[.]com
  • Domain: limefilescope[.]com
  • Domain: mangocloudfile[.]com
  • Domain: orangesmartfile[.]com
  • Domain: syncdatavault[.]com
  • Domain: cloudsendhub[.]com

  Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.