THE Microsoft Threat Intelligence team has analyzed a macOS ClickFix campaign that distributes information-stealing malware, including MacSync and Atomic Stealer (AMOS), using sophisticated server-side methods. The campaign evolved from openly serving malicious commands to employing a fingerprinting gate that restricts visibility to genuine macOS browser environments, thereby evading detection mechanisms. Key points include the following:
- **Technique**: ClickFix utilizes social engineering, prompting users to execute Terminal commands instead of traditional app installations. The current campaign leverages a fingerprinting gate to determine if a visitor is using a genuine macOS environment before showing the lure.
- **Cloaking Mechanism**: The server requires browser and hardware validation, filtering out automated systems and delivering the lure solely to qualified users.
- **Infection Chain**: Upon receiving the lure, victims execute commands that ultimately retrieve and execute the malware.
- **Mitigation Recommendations**: Users should be educated against pasting commands into Terminal; organizations need to monitor Terminal activities and unusual usage patterns;
- **Detection Tools**: Microsoft Defender provides coverage against such attacks, including monitoring behaviors linked to shell command executions and suspicious downloads.