A real ClickFix campaign used 250+ lookalike domains and browser fingerprinting to show malware lures mainly to real macOS visitors while showing harmless decoys to scanners and researchers. Victims were pushed to copy and run an obfuscated command in macOS Terminal, which then downloaded and launched info-stealing malware (Atomic Stealer/AMOS or MacSync).
This campaign relied on more than 250 lookalike domains built around the ClickFix technique. Rather than delivering malware directly through a download link, the sites used browser fingerprinting, checking signals like platform, screen size, timezone, WebGL details, iframe or VM checks, and whether developer tools were open, to decide what each visitor saw. Real macOS visitors could be shown a GitHub-themed download page complete with a fake verified-publisher badge, while crawlers, sandboxes, and researchers were often shown blank or benign decoy pages instead.
The page told the visitor that to finish installation, they needed to copy an obfuscated command and paste it into macOS Terminal. Running the command contacted a /curl/ path with an identifier, retrieved additional scripts, and launched the final payload, either Atomic Stealer (AMOS) or MacSync. AMOS is capable of stealing credentials, browser and authentication data, crypto wallets, and files.
The attack combined a familiar brand impression, a GitHub-style page and a verified badge, with a technique that puts the actual malicious action in the victim's own hands. Because the victim types and runs the command themselves, many traditional download-based defenses never trigger. The fingerprinting layer added another barrier: an apparently benign or look-alike response during investigation does not mean the domain is safe, since the same domain could serve very different content to a real user.
Organizations with macOS users, including developers and IT power users who are comfortable using Terminal, should reinforce that no legitimate installation process requires pasting a command into Terminal. Security operations and endpoint teams should also flag browsing activity followed by unusual Terminal behavior, such as curl commands piped into zsh or base64 decoding, as a detection layer that doesn't depend on catching the initial lure. Since verified-looking badges and familiar branding can be faked, teams should train staff to be suspicious of the requested action itself, not just the page's appearance.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It's a social engineering technique where a fake website, often mimicking a trusted brand like GitHub, instructs visitors to copy and paste an obfuscated command into macOS Terminal. Running the command downloads and launches info-stealing malware.
Over 250 lookalike domains used browser fingerprinting, checking signals like platform, screen size, timezone, WebGL info, and whether developer tools were open, to serve the malicious page only to real macOS visitors while showing scanners and researchers blank or benign decoy pages.
Victims who ran the Terminal command ended up with Atomic Stealer (AMOS) or MacSync, which can steal credentials, browser and authentication data, crypto wallets, and files.
Treat any website, chat message, or download page that asks you to paste a command into Terminal as malicious, even if it displays trust badges or looks like a familiar brand.
On your Mac, a GitHub-looking page pops up: “Download ready, to complete installation, copy the command below into Terminal.” Behind that page is a ClickFix campaign using over 250 lookalike domains and browser fingerprinting, only real macOS visitors see this lure, scanners just get blank decoys. If you paste that obfuscated curl command into Terminal, it quietly hits a /curl slash ID path, pulls down scripts, and drops info-stealing malware like Atomic Stealer onto your Mac. Here’s the rule: if any site tells you to copy a command into macOS Terminal, even with a shiny verified badge, stop and close the page.
Researchers reported a real phishing campaign (“Operation BlueDash”) that tricks users with a “secure document” lure and routes them to a fake Microsoft Store page that claims Microsoft Teams must be updated. The download installs legitimate remote access tools (Level RMM and ScreenConnect) so…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Attackers hijacked hotel/captive-portal Wi‑Fi infrastructure to redirect travelers to fake browser or operating system update pages and trick them into installing spyware. The operation (tracked as CaptiveCrunch) used DNS manipulation and user prompts (including “ClickFix” instructions) to get…
A threat landscape report describes how criminals now buy or rent phishing, fraud, malware, and hidden infrastructure “as a service,” making scams faster to launch and harder to stop. The article highlights practical, repeatable social-engineering workflows such as fake CAPTCHA pages that trick…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
Researchers and a Windows app developer uncovered a campaign using lookalike “official” software download websites that rank highly in Google results. The sites initially serve legitimate downloads to build trust, then quietly swap the download links to malware that can steal credentials and…
