Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download. Microsoft

The reported macOS ClickFix campaign uses server-side browser fingerprinting across more than 250 domains to selectively deliver infostealer lures (such as MacSync and Atomic Stealer) only to environments that appear to be genuine macOS browsers, while showing benign or blank content to crawlers, sandboxes, and non-targets.[1][2][3] This cloaking technique severely reduces visibility for automated security tooling and detection pipelines that rely on URL scanning or sandbox analysis rather than endpoint telemetry.[2][3] From a RealGround perspective, this illustrates how attackers use advanced fingerprinting and cloaking—techniques that can also be applied to AI-powered phishing sites and malware delivery—to evade automated defenses and target specific platforms. Organizations should incorporate continuous AI-driven red teaming to simulate such gated/fingerprinting delivery flows and ensure Secure AI Agent Build practices avoid trusting web content or environmental signals without robust validation and telemetry-backed monitoring.