The macOS ClickFix Scam Learned to Hide From Researchers
Microsoft says the fake-fix lure now checks your browser before showing itself, and a related campaign is pushing a new remote-control tool called ChainScript.
Key points
- Microsoft Threat Intelligence reported on August 5, 2026 that a long-running macOS ClickFix operation added a server-side fingerprinting gate that only shows the malicious lure to visitors who look like real Mac users.
- The campaign spreads information stealers, programs built to grab passwords and crypto wallets, including MacSync and Atomic Stealer (AMOS).
- Operators run a large family of algorithmically generated look-alike domains rather than a handful of fixed sites.
- A separate ClickFix wave, first reported by The Hacker News, drops a previously undocumented remote access trojan called ChainScript that impersonates Spotify, Zoom Workplace and Microsoft Teams installers.
- The cloaking trick means sandboxes and automated crawlers often see a blank page while real Mac users get the attack.
ClickFix is the scam of the year for Mac users, and it just got harder to catch.
The trick itself is old. A website tells you something is broken, a video won't play, a document won't open, and helpfully offers a fix: copy this command, paste it into Terminal, press return. What you actually paste downloads malware onto your Mac.
What changed, according to Microsoft, is who gets to see it.
What is ClickFix actually doing now?
The malicious page now inspects your browser before deciding whether to attack you. Microsoft's team calls it a server-side fingerprinting gate: the server checks the visitor's browser and operating system signals. If everything looks like a genuine person on a Mac using Safari or Chrome, the fake error message appears. Anything resembling a security scanner or a Windows machine gets a clean, blank page.
That matters because much of threat detection depends on automated tools visiting suspicious links and recording what happens. If the trap only springs for real victims, defenders see nothing and move on.
Microsoft watched the operation evolve over several weeks. Earlier versions put the malicious command straight into the page's source code, where any crawler could read it. The current version hides it behind the fingerprinting check. We covered this infrastructure in detail on 5 August in "Fake Mac Downloads Hide Behind 250+ Domains That Screen Visitors First".
What is the malware after?
Money and access. The payloads Microsoft has seen include MacSync and Atomic Stealer, also known as AMOS, two infostealers hunting for saved browser passwords, session tokens, cryptocurrency wallets and keychain data. Once exfiltrated, that data typically surfaces on criminal forums within hours. AMOS is no stranger to this kind of abuse: our 30 August story on hijacked Anthropic accounts found the same class of infostealer lifting active Claude sessions from infected Macs.
| Element | Detail |
|---|---|
| Campaign | macOS ClickFix, tracked by Microsoft Threat Intelligence |
| Reported | August 5, 2026 |
| Payloads | MacSync, Atomic Stealer (AMOS) |
| New tactic | Server-side browser fingerprinting to cloak the lure |
| Infrastructure | Large family of algorithmically named look-alike domains |
Where does ChainScript fit in?
A parallel campaign, documented by Blackpoint's Adversary Pursuit Group and first reported by The Hacker News, uses the same ClickFix style of lure to install ChainScript, a previously undocumented remote access trojan. It's shipped under build names including ComponentTask33, UpdateDigital, HostShared and OrchidViolet66, disguising itself as installers for Spotify, Zoom Workplace and Microsoft Teams.
Blackpoint's writeup and Microsoft's blog describe different tooling. Don't conflate them without more evidence. Fake-fix social engineering, brand impersonation and rotating infrastructure are common across several clusters right now. Medium confidence that we're looking at a broader ecosystem of ClickFix operators rather than one crew.
My read: the fingerprinting gate is the more important story. Rotating command-and-control is standard tradecraft. Selectively serving malware to real humans while showing researchers a clean page erodes the industry's baseline visibility, and if it works here, expect it on Windows lures within months.
What should Mac users actually do?
Never paste a command into Terminal because a website told you to. That's the whole attack. Legitimate sites, including Apple, Google and Zoom, won't ask you to open Terminal to fix a video player or a document viewer. If a page tells you to, close the tab.
