Over 250 Click Fix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
Summary: Microsoft Threat Intelligence tracked a macOS ClickFix operation spanning more than 250 front-end domains that fingerprints visitors server-side before serving a malware lure, and the chain it analyzed through the gate ended in Atomic Stealer (AMOS). The roughly 2.5 KB JavaScript gate reads navigator platform, screen and window dimensions, WebGL signals, timezone, iframe status and touch support, and includes two probes aimed at analysts: a developer-console counter and a canPlayType("video/mp4") tripwire, with the bundle tagged mode:"php" and sent back without user interaction.
What's compelling: Because the decision happens per request, two visits to the same address can return entirely different pages, so a blank or look-alike response tells you nothing about whether a domain is malicious. Microsoft did not disclose victim numbers, targeted sectors, or the operators' identity, leaving the campaign's scale unknown while the gate keeps it hidden from the crawlers and sandboxes most teams rely on.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026