Fake Mac Downloads Hide Behind 250+ Domains That Screen Visitors First

Key points

• Microsoft Threat Intelligence has tracked more than 250 web domains pushing a fake macOS software download through a scam known as ClickFix.
• Each site fingerprints visitors' browsers before deciding whether to serve the malicious page, hiding it from security researchers.
• The lure targets Mac users only, appearing as a routine "install this to continue" prompt.
• Automated scanners and crawlers see a harmless decoy, which slows detection.
• Any website that suddenly asks you to run a downloaded file or paste a command into Terminal should be treated as hostile.

A long-running scam aimed at Apple computer owners just got quieter and harder to spot.

Microsoft's threat researchers say a network of more than 250 websites now screens each visitor before showing a fake software download. The technique means an ordinary Mac user sees the trap while a security analyst examining the same link sees nothing suspicious. Microsoft Threat Intelligence had been watching the same infrastructure for weeks before the fingerprinting step came into view.

ClickFix is the name for a class of attack where a website tells you something is broken and instructs you to fix it by downloading an installer or pasting a command into Terminal. Either way, what runs is malware. We reported in July on two separate ClickFix campaigns that stripped browser passwords and session tokens from workers with no software flaw required.

What is actually happening on these sites?

When someone visits one of the 250-plus front-end domains, the server reads their browser details: operating system, language, screen size. This is called browser fingerprinting. If the result looks like a real Mac user on a home or office connection, the site loads the fake download page. If it looks like a security sandbox (an isolated test machine researchers use to open suspicious files) or a crawler, the visitor gets a bland decoy.

That gate is the meaningful change. It lets a domain look entirely clean to a scanning tool in the morning and serve malware to a staff member an hour later.

Why does this matter for regular Mac users?

Apple's reputation for safety rests partly on the idea that macOS malware is rare. ClickFix chips away at that without touching the operating system. It exploits the person, persuading them to run the malicious software themselves.

The pitch is mundane by design. A video won't play until you install a codec. A CAPTCHA is broken and you must paste a "verification command" into Terminal. Those are the red flags. Multi-factor authentication, the extra login code many services require, wouldn't have stopped this. The victim hands over control of their own computer, not a login.

How the campaign compares

What should Mac users do right now?

Close any tab that instructs you to download and run a file or paste a command into Terminal. Legitimate software updates arrive through the App Store, through System Settings, or from a vendor's site you navigated to yourself.

If you already ran something suspicious, disconnect from the internet, change passwords from a separate device, and have the machine examined. Clear browser sessions too: stealer malware routinely harvests session cookies, the small files that keep you signed into websites.

Should you worry about your security tools catching this?

URL blocklists alone will lag this campaign because the fingerprinting layer means a domain can appear clean to your scanner and serve malware to a colleague minutes later. Apple's built-in Gatekeeper and XProtect will catch some payloads, but coverage isn't immediate or complete. The weak link, as ever, is the click.