Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

A large-scale ClickFix operation involving over 250 domains has been found to use browser fingerprinting to determine which visitors to show malware lures to. This tactic allows the operation to hide the malicious content from crawlers and sandboxes, while targeting specific Mac users with fake software downloads. Microsoft Threat Intelligence has been tracking the infrastructure behind this operation for weeks, observing the use of server-side gates to control who sees the malware. The fingerprinting technique enables the operation to selectively present the malicious page to chosen visitors. The goal of this approach is to evade detection and present a fake download to targeted Mac users. Microsoft has been monitoring the development of this tactic.