Fake Mac Downloads Hide Behind 250+ Domains That Screen Visitors First

Key points

• Microsoft Threat Intelligence has tracked more than 250 web domains pushing a fake macOS software download through a scam known as ClickFix.
• The sites now check each visitor's browser details before deciding whether to serve the malicious page, hiding it from security researchers.
• The lure targets Mac users only, and appears as a routine "install this to continue" prompt.
• Automated scanners and search engine crawlers are shown a harmless page, which delays detection.
• Mac users should treat any website that suddenly asks them to run a downloaded file or paste a command into Terminal as hostile.

A long-running scam aimed at Apple computer owners just got quieter and harder to spot.

Microsoft's threat researchers say a network of more than 250 websites is now screening each visitor before showing them a fake software download. The technique, first reported by The Hacker News, means an ordinary Mac user sees the trap while a security analyst poking at the same link sees nothing suspicious.

The campaign uses a trick called ClickFix. That is where a website tells you something is broken and instructs you to "fix" it by copying a command into your Mac, or by downloading and running an installer. The command or installer is the malware.

What is actually happening on these sites?

When someone visits one of the 250-plus front-end domains, the server behind the site quickly reads details about their browser: what operating system they run, what language they use, what plugins are loaded, screen size, and so on. This is called browser fingerprinting.

If the fingerprint looks like a real Mac user on a normal home or office connection, the site loads the fake download page. If it looks like a security tool, a search engine crawler, or a sandbox (an isolated test computer researchers use to safely open suspicious files), the site shows a bland decoy page or an error.

That gate is the important change. Microsoft had been watching the same infrastructure for weeks, and the fingerprinting step is what made the operation harder to catalogue at scale.

Why does this matter for regular Mac users?

Apple's reputation for safety leans heavily on the idea that malware for macOS is rare. ClickFix chips away at that. It does not exploit a hidden flaw in the operating system. It exploits the user, by asking them to run the malicious software themselves.

The pitch is usually mundane. A video will not play until you install a codec. A document viewer needs updating. A CAPTCHA is broken and you must paste a "verification command" into the Terminal app. Each of those is a red flag.

Multi-factor authentication, the extra login code many services now require, would not have stopped this one. The victim is handing over control of their own computer, not a login.

How the campaign compares

What should Mac users do right now?

Treat any website that suddenly instructs you to download and run a file, or to paste a command into Terminal, as hostile. Close the tab. Real software updates come from the App Store, from System Settings, or from the vendor's own website that you typed in yourself.

If you already ran something you now regret, disconnect from the internet, change passwords from a different device, and get the machine checked. Reset any browser sessions, because stealer malware often grabs saved logins and session cookies (small files that keep you signed in to websites).

For IT teams, the practical takeaway is that URL blocklists alone will lag this campaign. The fingerprinting layer means a domain can look clean to your scanning tool at 9am and serve malware to a staff member at 10am.

Apple's built-in Gatekeeper and XProtect will catch some payloads, but not all, and not immediately. The weak link, as ever, is the click.