Cloaked Mac ClickFix Sites Push Terminal Infostealers

Microsoft Threat Intelligence tracked a real macOS “ClickFix” campaign that uses look‑alike domains to trick Mac users into copying and running a Terminal command. The operation now hides the malicious “Download for macOS” lure behind server-side browser fingerprinting, showing benign decoy pages to scanners and non‑Mac visitors while delivering infostealers like Atomic Stealer (AMOS) to likely Mac targets.

Key findings

• Campaign distributes macOS information stealers including MacSync and Atomic Stealer (AMOS).
• Operators shifted from openly serving the malicious command in page HTML to a server-side fingerprinting gate that selectively reveals the lure to likely macOS visitors.
• Same URL can show either the ClickFix lure or a benign decoy (e.g., fake VPN/extension landing page), reducing defender visibility and complicating investigation.
• Lure is a fake “Download for macOS” page with a forged “Verified Publisher” badge and a one-click copy of an obfuscated curl one-liner that users are instructed to run in Terminal.
• Domain infrastructure includes mass-produced, dictionary-style look-alike names (often using the token “file”).

Who’s being targeted

• Commonly targeted roles: All employees who use macOS, Executives and assistants (frequent web downloads), IT helpdesk and desktop support, Security awareness training audience, Security operations/Threat hunting (for cloaking/TDS awareness).
• Affected industries: Any organization with macOS endpoints.
• Attack channels: website.
• Impersonated: A macOS software publisher/download site (with a forged trust badge), A benign product or business website (e.g., VPN/extension landing page or unrelated company site).

Awareness takeaways

• Treat any site that tells you to paste and run Terminal commands to “complete a download” as suspicious, stop and verify through official vendor channels.
• Don’t trust “verified/publisher” badges or polished download pages by themselves; verify the domain and source before downloading or running anything.
• Security teams should not assume a domain is safe just because automated scans show benign content; cloaking can hide the real lure from crawlers and sandboxes.
• macOS users should be trained to recognize “Download for macOS” lures and report them immediately, especially if the page offers a one-click copy command.

Red flags to watch for

• Website asks you to run a Terminal command instead of installing a normal macOS app
• Trust indicator looks fake (e.g., forged “Verified Publisher” badge)
• Domain name looks random/dictionary-generated or unrelated to the software being downloaded
• Same URL can show different content depending on device/browser
• Site appears blank/parked or unrelated to the domain purpose
• Benign-looking content may still be hosted on malicious infrastructure