Historical intelligence backfill. This assessment covers reporting originally published on 2026-08-05 and was added to the RWP archive on 2026-09-07.
macOS ClickFix learned a fingerprinting gate so scanners saw a blank page
Microsoft watched look-alike domains serve MacSync and AMOS only after the browser looked like a real Mac — Terminal paste, not a DMG.
Bottom line up front
CONFIRMED 5 August 2026 Microsoft — macOS ClickFix cluster of look-alike domains delivering MacSync and Atomic Stealer (AMOS). Evolution: not every visitor gets the lure. Server-side browser fingerprinting shows "Download for macOS" + copied Terminal command mainly to clients that look like a genuine Mac browser. Payload is remote content via Terminal, not a user-mounted DMG. Some pages still had the full command in HTML, so a non-JS scanner could recover the chain; the gate is about hiding from Windows crawlers and sandboxes, not about cryptography.
Historical backfill of 5 August 2026 reporting; added 7 September 2026.
What happened
ClickFix on Mac caught up with web cloaking. Terminal is the installer.
Why it mattered
Mac fleet "we don't get Windows stealers" is false. Fingerprinting means your URL-reputation crawl from a data-center UA never sees the lure.
Who / what was affected
macOS users hitting the domain cluster. Counts UNKNOWN.
Technical context
Fetch with a real Safari UA in the sandbox. Hunt osascript/curl from Terminal spawned after a browser. Block known AMOS/MacSync C2.
Exploitation / threat status at the time
CONFIRMED Microsoft campaign evolution.
UNKNOWN operator name.
What defenders should have done
- MDM that makes random Terminal pastes loud.
- Reputation crawlers that look like Macs.
- User rule: never paste from a download page into Terminal.
RWP assessment
Confidence: High. Same primitive as TerminalFix, different OS.
Defensive actions
- Gate Terminal to developers.
- Dual-OS ClickFix tabletop.
- Do not declare a URL clean from a Linux crawler.