threat-intel
Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
High
Summary
A macOS ClickFix operation is using browser fingerprinting to deliver malware lures to a targeted subset of Mac users. The operation, involving over 250 domains and distributing malware like MacSync and AMOS, hides the malicious pages from automated analysis and requires users to paste and run an obfuscated command in Terminal to retrieve the payload. Microsoft recommends focusing on blocking the fingerprinting gate and shared staging infrastructure rather than chasing individual domains.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data