macOS ClickFix Campaign Adopts Browser Fingerprinting to Hide Infostealer Lures — Detection and Hunting Guide

A macOS ClickFix campaign has undergone a meaningful tactical evolution. According to Microsoft's threat research, operators who previously served infostealer lures openly from their infrastructure have shifted to gating their malicious content behind browser fingerprinting. In plain terms: the attack chain now inspects the visitor's browser and device characteristics before deciding whether to serve the lure at all. Security scanners, sandboxes, and researcher crawlers get nothing — or a benign decoy. Only what the operator believes is a genuine macOS victim receives the ClickFix page and its embedded terminal command.

This matters for two reasons. First, it degrades the network-layer visibility many SOCs rely on: URL reputation feeds, automated crawlers, and sandbox detonation services will increasingly see clean content from this infrastructure. Second, it pushes detection weight back onto the endpoint, where the actual ClickFix execution — a user pasting a base64-encoded or obfuscated command into Terminal or being walked through Launchpad — remains loudly observable. If your macOS fleet has no process execution telemetry feeding your SIEM, this campaign class is effectively invisible to you.

ClickFix-style social engineering has been one of the fastest-growing initial access vectors of 2025–2026. The macOS variant typically delivers infostealers that harvest browser credentials, session cookies, cryptocurrency wallets, and keychain material — data that feeds directly into account takeover, session hijacking, and follow-on intrusion. The fingerprinting gate tells us these operators are investing in operational security, which correlates with mature, revenue-generating criminal infrastructure. Treat this as a signal to validate your macOS detection coverage now, not after an incident.

Technical Analysis

What the campaign is doing

ClickFix is not a vulnerability — it is pure social engineering mapped to MITRE ATT&CK T1204 (User Execution). The classic flow:

1. The victim lands on a compromised or attacker-operated page (malvertising, SEO poisoning, typosquatted domains, or compromised legitimate sites).
2. The page presents a fake CAPTCHA, a fake "browser update required," or a fake "fix this error" dialog.
3. The victim is instructed to open Terminal (or is walked through Finder → Applications → Utilities → Terminal) and paste a command.
4. The pasted command is typically a curl/wget download piped to bash or zsh, frequently with base64-encoded segments to frustrate casual inspection. On macOS, the executed payload then pulls an infostealer binary (historically families such as Atomic macOS Stealer (AMOS), Poseidon, or Cuckoo-style stealers), often signed with stolen or ad-hoc developer certificates to reduce Gatekeeper friction.

The tactical shift: browser-fingerprinting gating

The new wrinkle documented by Microsoft is that the lure infrastructure now performs client-side and server-side fingerprinting before disclosing the malicious content:

• User-Agent and platform checks — the gate looks for genuine macOS Safari/Chrome signatures and macOS platform indicators (including navigator.platform behavior on real browsers).
• Headless/automation detection — sandboxes, scanners, and crawlers frequently expose themselves through missing or anomalous browser APIs, missing font enumerations, WebGL renderer strings, or automation flags. The gate refuses to serve the lure to these visitors.
• Conditional content delivery — non-qualifying visitors receive benign content, a redirect, or nothing, meaning URL scanning services and reputation feeds see the infrastructure as clean.

Why this breaks traditional defenses

The endpoint is now the highest-fidelity detection surface for this campaign class.

Observable behaviors on the endpoint

Regardless of gating, the victim-side execution chain produces consistent, high-signal artifacts:

• Terminal.app, iTerm2, or similar shells spawning curl or wget with piping to an interpreter (bash, zsh, sh, python, osascript).
• Base64 blobs in command lines, especially echo <blob> | base64 -D | sh or curl ... | bash patterns.
• Execution of unsigned or ad-hoc signed Mach-O binaries from /tmp, ~/Downloads, ~/Library, or /Users/Shared.
• Infostealer behaviors: rapid reads of browser profile stores (~/Library/Application Support/Google/Chrome, ~/Library/Application Support/Firefox, Safari cookie stores), Keychain access attempts, security find-generic-password invocation, and collection of files under ~/Documents/~/Desktop into an archive.
• Persistence attempts via LaunchAgents (~/Library/LaunchAgents/*.plist) where the stealer drops a follow-on implant.
• Egress to recently registered or low-reputation domains shortly after Terminal-spawned curl activity.

Exploitation status

This is a confirmed, actively observed campaign tracked by Microsoft as in-the-wild. It is social engineering, not a CVE — no vulnerability identifier applies, and none should be invented. There is no patch; defense is entirely behavioral: user hardening, endpoint telemetry, and egress control.

Detection & Response

The following rules and queries target the endpoint execution chain, which remains observable regardless of the fingerprinting gate. All are written to be high-signal; none should generate meaningful noise in a well-managed macOS estate.

Sigma Rules

---
title: macOS Terminal-Spawned Download-and-Execute (ClickFix Pattern)
id: 8f4c2a71-3b6e-4d19-9c82-5a7e1f0b2d43
status: experimental
description: Detects curl/wget spawned by a terminal emulator on macOS piping content to a shell or interpreter — the core ClickFix execution pattern used in macOS infostealer campaigns.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
      - '/Terminal'
      - '/iTerm2'
      - '/WarpTerminal'
      - '/Alacritty'
      - '/kitty'
  selection_child:
    Image|endswith:
      - '/curl'
      - '/wget'
  selection_pipe:
    CommandLine|contains:
      - '| bash'
      - '| zsh'
      - '| sh'
      - '|bash'
      - '|zsh'
      - '|sh'
      - 'base64 -D'
      - 'base64 --decode'
  condition: selection_parent and selection_child and selection_pipe
falsepositives:
  - Legitimate developer installation scripts run manually (e.g., Homebrew-style installers)
level: high
---
title: macOS Base64 Decode Piped to Shell Execution
id: 2d7b9f34-6c1a-4e58-b734-9f0c3a5d8e61
status: experimental
description: Detects base64 decoding piped directly to a shell interpreter on macOS, a common obfuscation step in ClickFix paste-to-terminal lures delivering infostealers.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/
  - attack.t1027
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection_decode:
    CommandLine|contains:
      - 'base64 -D'
      - 'base64 --decode'
      - 'base64 -d'
  selection_shell:
    CommandLine|contains:
      - '| sh'
      - '| bash'
      - '| zsh'
      - '|sh'
      - '|bash'
      - '|zsh'
  condition: selection_decode and selection_shell
falsepositives:
  - Rare administrative scripting; validate against change records
level: high
---
title: macOS Infostealer Credential and Browser Store Access
id: 5c1e8a96-4f27-4b83-a6d0-2e9f7b1c4a58
status: experimental
description: Detects suspicious access to macOS browser credential stores and keychain by processes without a legitimate browser parent — consistent with AMOS/Poseidon-style infostealer collection behavior following ClickFix delivery.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/
  - https://attack.mitre.org/techniques/T1555/
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1555
logsource:
  category: file_event
  product: macos
detection:
  selection_path:
    TargetFilename|contains:
      - '/Library/Application Support/Google/Chrome/Default/Login Data'
      - '/Library/Application Support/Google/Chrome/Default/Cookies'
      - '/Library/Application Support/Firefox/Profiles'
      - '/Library/Keychains/login.keychain'
      - '/Library/Cookies/Cookies.binarycookies'
  filter_browsers:
    Image|endswith:
      - '/Google Chrome'
      - '/firefox'
      - '/Safari'
      - '/Google Chrome Helper'
      - '/CookieMiner'
  condition: selection_path and not filter_browsers
falsepositives:
  - Enterprise backup or DLP agents reading browser stores; allowlist known agents
level: high

KQL — Microsoft Sentinel / Defender for Endpoint (macOS)

MDE on macOS populates the same DeviceProcessEvents/DeviceNetworkEvents schema, so these run directly in Advanced Hunting and Sentinel. The first query hunts the paste-to-terminal execution chain; the second correlates terminal-spawned downloads with outbound connections to hunt post-gate infrastructure that reputation feeds have missed.

// Hunt 1: Terminal-spawned download-and-execute (ClickFix execution chain)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where DeviceOS has "macOS" or DeviceOS has "Darwin"
| where InitiatingProcessFileName in~ ("Terminal", "iTerm2", "WarpTerminal", "zsh", "bash")
| where FileName in~ ("curl", "wget", "base64", "osascript")
| where ProcessCommandLine has_any ("| sh", "| bash", "| zsh", "|bash", "|zsh", "|sh", "base64 -D", "base64 --decode", "chmod +x")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
          FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;

// Hunt 2: Network egress within 10 minutes of terminal-spawned curl (post-gate payload + C2)
let SuspiciousTerminal =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName in~ ("Terminal", "iTerm2", "zsh", "bash")
    | where FileName in~ ("curl", "wget")
    | where ProcessCommandLine has_any ("| sh", "| bash", "| zsh", "base64")
    | project DeviceName, DownloadTime=TimeGenerated, ProcessCommandLine;
SuspiciousTerminal
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName !in~ ("Google Chrome", "Safari", "firefox", "Microsoft Edge")
) on DeviceName
| where TimeGenerated between (DownloadTime .. DownloadTime + 10m)
| project DeviceName, DownloadTime, ProcessCommandLine, TimeGenerated,
          RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
| order by DeviceName, DownloadTime desc;

// Hunt 3: New unsigned/ad-hoc Mach-O executed from user-writable staging paths
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("/tmp/", "/Users/Shared/", "/Downloads/", "/Library/Caches/")
| where InitiatingProcessFileName in~ ("bash", "zsh", "sh", "curl")
| summarize FirstSeen=min(TimeGenerated), Commands=make_set(ProcessCommandLine)
    by DeviceName, FileName, FolderPath, SHA256, Signer
| order by FirstSeen desc;

Velociraptor VQL — macOS Fleet Hunt

This artifact sweeps a macOS fleet for the two most reliable host artifacts: terminal-spawned downloaders in process space and recently created LaunchAgents plists (the common persistence foothold for stealer follow-on implants).

-- macOS ClickFix hunt: terminal-spawned downloaders + suspicious LaunchAgents
-- Part 1: Processes spawned by terminal emulators performing download/decode
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(curl|wget).*(\| *sh|\| *bash|\| *zsh|base64)'
   OR (Name =~ '^(curl|wget|base64|osascript)$'
       AND Exe =~ '(Terminal|iTerm|zsh|bash)')

-- Part 2 (run separately): Recently created LaunchAgents persistence
SELECT FullPath, Btime as BirthTime, Mtime as ModifiedTime, Size,
       read_file(filename=FullPath, length=4096) as PlistHead
FROM glob(globs=['/Users/*/Library/LaunchAgents/*.plist',
                 '/Library/LaunchAgents/*.plist'])
WHERE Mtime > now() - 604800
  AND NOT FullPath =~ '(com\.apple|com\.google|com\.microsoft|com\.adobe|com\.zoom)'
ORDER BY Mtime DESC

Remediation & Hardening Script (macOS — Bash/MDM-deployable)

Deploy via your MDM (Jamf, Kandji, Intune) or run interactively during IR. It audits for ClickFix artifacts, checks for unsigned LaunchAgents, and optionally applies Gatekeeper hardening.

#!/bin/bash
# Security Arsenal — macOS ClickFix/infostealer audit & hardening
# Run with sudo for full keychain/LaunchAgents visibility

echo "=== [1] Recent LaunchAgents not from known vendors (last 30 days) ==="
find /Users/*/Library/LaunchAgents /Library/LaunchAgents -name "*.plist" -mtime -30 2>/dev/null | while read p; do
  case "$p" in
    *com.apple*|*com.google*|*com.microsoft*|*com.adobe*|*com.zoom*|*com.jamf*) ;;
    *) echo "[REVIEW] $p"; grep -A1 "ProgramArguments" "$p" 2>/dev/null | head -4 ;;
  esac
done

echo "=== [2] Executables staged in user-writable temp/shared paths (last 14 days) ==="
find /tmp /var/tmp /Users/Shared /Users/*/Downloads -type f -perm +111 -mtime -14 2>/dev/null | while read f; do
  sig=$(codesign -dv "$f" 2>&1 | grep -i "Signature=" | head -1)
  echo "[BIN] $f  ->  ${sig:-unsigned}"
done

echo "=== [3] Ad-hoc or unsigned Mach-O binaries in user Library (last 30 days) ==="
find /Users/*/Library -type f -perm +111 -mtime -30 2>/dev/null | while read f; do
  if file "$f" | grep -q "Mach-O"; then
    auth=$(codesign -dv "$f" 2>&1 | grep -i "Authority=" | head -1)
    [ -z "$auth" ] && echo "[UNSIGNED/ADHOC] $f"
  fi
done

echo "=== [4] shell history indicators of paste-to-terminal execution ==="
for h in /Users/*/.zsh_history /Users/*/.bash_history; do
  [ -f "$h" ] && grep -nE 'curl .*(\| *(sh|bash|zsh))|base64 (-D|--decode).*\|' "$h" 2>/dev/null | sed "s|^|[$h] |"
done

echo "=== [5] Gatekeeper / quarantine posture check ==="
spctl --status
defaults read /Library/Preferences/com.apple.security GKAutoRearm 2>/dev/null || echo "GKAutoRearm not enforced — consider enabling via MDM"

echo "=== [6] Recent outbound connections from non-browser processes (snapshot) ==="
lsof -i -P -n 2>/dev/null | grep ESTABLISHED | grep -viE 'chrome|safari|firefox|msedge|jamf|mdmd|com.apple' | head -25

echo "=== Audit complete. Escalate any [REVIEW]/[UNSIGNED/ADHOC]/history hits to IR. ==="

Remediation

Immediate actions (this week)

1. Validate macOS endpoint telemetry coverage. This campaign class defeats network-layer crawlers; if your macOS fleet isn't shipping process execution events (MDE for macOS, CrowdStrike, Jamf Protect, or osquery) to your SIEM, you are blind. Confirm Terminal/iTerm child-process visibility specifically.
2. Deploy the detection content above and back-test against 7–30 days of historical telemetry. Any hit on the download-and-execute pattern warrants a credential-reset response by default.
3. Run the audit script (or equivalent MDM job) across your macOS estate to surface staged unsigned binaries and rogue LaunchAgents.

If you confirm a victim

1. Isolate the host from the network immediately — stealer exfiltration is typically complete within minutes of execution, but follow-on implants may persist.
2. Assume full credential compromise for that user. Reset all credentials accessible from the device: IdP/SSO sessions (revoke tokens, not just passwords — session cookies are the primary theft target), browser-stored passwords, cryptocurrency wallets, SSH keys, cloud CLI tokens (~/.aws, ~/.azure, ~/.config/gcloud), and anything recoverable from the Keychain.
3. Rotate session tokens at the IdP. Infostealers monetize session cookies to bypass MFA. Force reauthentication and revoke active sessions in Entra ID/Okta/Google Workspace.
4. Image or thoroughly remediate the endpoint. Infostealers frequently drop second-stage persistence; collection-only cleanup is insufficient.
5. Review downstream authentication logs for anomalous logins using the victim's identity in the 72 hours following execution — impossible travel, new device fingerprints, or sessions lacking MFA claims.

Structural hardening

• User awareness, targeted at the actual TTP: train macOS users that no legitimate website, CAPTCHA, or error dialog will ever ask them to open Terminal and paste a command. This single message kills the entire ClickFix class.
• Application control: enforce Gatekeeper with auto-rearm, and consider blocking unsigned executable launch from /tmp, /Users/Shared, and Downloads via Santa, Jamf Protect, or MDE custom indicators.
• Egress filtering: since the fingerprinting gate defeats reputation feeds, lean on behavioral egress rules — alert on first-seen domain contact from non-browser processes, especially within minutes of Terminal activity.
• Threat intelligence sharing: because these domains stay unclassified in feeds, internal reporting loops matter. When a user reports a suspicious "fix this error" page, capture the domain manually and push it to your blocklist — don't wait for a vendor feed.

There is no vendor patch or CISA KEV entry applicable here — this is a social engineering campaign, not an exploited vulnerability. The remediation is telemetry, identity response, and user hardening. Microsoft's original reporting is available at the Microsoft Security Blog.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub